EUVD-2026-38104
GHSA-m735-jrv9-j3fc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify site running Contact Form Entries ≤1.5.1
-
DeliverySubmit form with bracket-crafted JSON key targeting wp-config.php
-
ExploitPayload stored in entries table
-
InstallAdministrator opens entry in wp-admin
-
C2view_page bypasses isset check and calls unlink
-
Executewp-config.php deleted, install wizard exposed
-
ImpactAttacker reconfigures DB to achieve RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable plugin Database for Contact Form 7, WPforms, Elementor forms (contact-form-entries) version ≤1.5.1 must be installed and active on a WordPress site with at least one form whose submissions are routed through the plugin's entry storage. No authentication is required to plant the payload (PR:N), but exploitation only completes when an administrator subsequently views or edits the poisoned entry in wp-admin (UI:R required, per CVSS vector and description), so dormant sites with no admin triage are not exploitable in practice. The traversal also depends on PHP's bracket-parser behavior reshaping the attacker-crafted JSON key, which is standard PHP behavior and not a non-default configuration. |
| Impact | CVSS 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) accurately reflects a two-stage attack: anyone on the internet can plant the payload (PR:N), but the destructive action only fires when an administrator opens the poisoned entry (UI:R), which is highly likely on any active WordPress site that triages submissions. There is no EPSS, SSVC, or KEV data in the input, so quantitative exploitation probability is unknown; however, the combination of unauthenticated submission, a public Wordfence advisory with technical detail, and a trivially weaponizable RCE path via wp-config.php deletion makes this a near-term priority for any site running the plugin. Confidentiality is rated N because the primitive is deletion rather than read, but the practical I:H/A:H impact (site takeover after re-installation hijack) means defenders should treat it as functionally equivalent to authenticated RCE. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a contact form on a vulnerable WordPress site, embedding a crafted field name with bracket/JSON-key traversal payload pointing at wp-config.php; the entry is stored without immediate effect. When a site administrator later opens the entry in the Contact Form Entries admin UI, the view_page handler resolves the poisoned key, bypasses the isset() guard, and unlinks wp-config.php, causing WordPress to enter the installation wizard so the attacker can re-point the site to a database they control and gain full RCE - a primitive consistent with the technical detail published in the Wordfence advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 20, 2026
Arbitrary file deletion in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions ≤1.5.1) allows remote unauthenticated attackers to poison form entries with traversal payloads that, when later viewed by an administrator, delete arbitrary server files and can be escalated to remote code execution by removing wp-config.php. Reported by Wordfence with publicly available exploit code exists via the Wordfence advisory; no public exploit identified at time of analysis as weaponized in-the-wild attacks, and the issue is not in CISA KEV.
RemediationAI
Upstream fix available (changeset 3578556); released patched version not independently confirmed beyond '> 1.5.1', so administrators should update the Contact Form Entries plugin to the latest available release from the WordPress.org plugin repository as soon as it is published and verify the installed version is greater than 1.5.1. Until the update is applied, deactivate the plugin or restrict the wp-admin entry-viewing screens (the view_page handler) via web-server ACLs or a WAF rule that blocks form submissions containing bracket characters or '../' sequences in field names, accepting the trade-off that legitimate admins cannot triage entries while the rule is active; additionally, take a full backup of wp-config.php and the webroot so that an attacker-triggered deletion cannot be silently followed by a re-installation hijack. Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/4169b390-0972-4aa9-ae04-f5f67afe15ef?source=cve) and the patched code at https://plugins.trac.wordpress.org/changeset/3578556/contact-form-entries for indicators of compromise in stored form entries.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The plugin (CPE cpe:2.3:a:crmperks:database_for_contact_form_7,_wpforms,_elementor_forms) stores user-submitted form entries and exposes a view_page handler that calls a file deletion routine on entry attachments. The root cause is CWE-22 (Path Traversal) compounded by a PHP-specific parser quirk: PHP's bracket notation in $_POST/$_GET keys (e.g. names containing '[' or '.') is normalized into nested arrays, so an attacker-crafted JSON key reshapes into a structure that bypasses the isset() check on the stored sanitized path while still resolving to a traversal-controlled filesystem path inside the unlink() call. Affected source paths include includes/plugin-pages.php:1197, contact-form-entries.php:747 and :435, includes/data.php:539, and templates/view.php:559.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Network-reachable form submission with no auth (AV:N/PR:N), but deletion only fires when an admin views the entry (UI:R); arbitrary file deletion yields I:H/A:H with no direct read (C:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file.
Executive ViewAI
A high-severity arbitrary file deletion vulnerability in WordPress form plugins (Database for Contact Form 7, WPforms, Elementor Forms ≤1.5.1) allows unauthenticated attackers to delete critical server files and achieve remote code execution by removing wp-config.php. This exposes all WordPress sites using these plugins to complete system compromise and data loss. With publicly available exploit code exists and no vendor-released patch identified at time of analysis, immediate mitigation is critical.
Immediately uninstall vulnerable plugin versions; implement filesystem-level write/delete restrictions on wp-config.php via web server user permissions; deploy WAF rules targeting form submission injection patterns; enable file integrity monitoring on all critical configuration files; restrict form submissions to authenticated users if operationally feasible; maintain immutable offline backups; implement server-level file deletion prevention through OS access controls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB