Contact Form Entries CVE-2026-9145

Exploitation requires three co-present conditions: (1) the Contact Form Entries plugin version ≤ 1.5.1 must be installed and active; (2) Elementor Pro must be installed and active on the same WordPress instance - it is the sole provider of the elementor_pro/forms/new_record action hook that triggers create_entry_el(); and (3) at least one Elementor Pro form must contain an upload-type field, which causes the Form_Record object to expose raw_value for that field. No authentication is required (CVSS PR:N confirmed by vector). No user interaction is required (UI:N). Exploitation is limited by the attacker's inability to directly observe the copied file's destination path - the hashed directory name is never returned in the response, so a secondary vulnerability or information leak would be needed to retrieve the exfiltrated file. The CVSS AC:H rating reflects the Elementor Pro dependency as the principal attack complexity factor.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, score 6.5) correctly captures the dual nature of this flaw: unauthenticated and network-reachable, but gated behind a high-complexity precondition (Elementor Pro must be installed and a form with an upload-type field must exist). AC:H is the key limiting factor - without Elementor Pro the vulnerable hook never fires. EPSS data was not supplied, and there is no CISA KEV listing and no known public proof-of-concept, so real-world exploitation remains unconfirmed. However, Elementor Pro is one of the most commercially popular WordPress page builders, meaning the co-installation scenario is not rare in practice. The I:L rating reflects that copy() writes a file to an attacker-invisible hashed path, which reduces immediate impact but does not eliminate it - a secondary information leak could reveal the destination. The confidentiality impact is genuinely high: targeting wp-config.php or .env files could yield database credentials and secret keys. Missing data: no EPSS score, no patch version, and no independent verification that a fix has been released.

An unauthenticated attacker submits a crafted POST request to a WordPress site running both Elementor Pro and Contact Form Entries ≤ 1.5.1, targeting an Elementor Pro form that includes an upload-type field. The attacker sets the upload field's POST value to an absolute path such as /var/www/html/wp-config.php; because no file exists in $_FILES, create_entry_el() treats this string as raw_value and passes it to copy(), which copies the configuration file into the plugin's hashed upload staging directory. No public proof-of-concept has been identified at time of analysis, but the attack requires only a standard HTTP client and knowledge of a valid Elementor Pro form endpoint.