What is the CVSS score of CVE-2026-9843?

CVE-2026-9843 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Contact Form Entries are affected by CVE-2026-9843?

A high-severity arbitrary file deletion vulnerability in WordPress form plugins (Database for Contact Form 7, WPforms, Elementor Forms ≤1.5.1) allows unauthenticated attackers to delete critical…

How to fix or mitigate CVE-2026-9843?

Within 24 hours: Immediately disable or uninstall affected plugin versions (≤1.5.1); audit server logs for suspicious form submissions and file deletion attempts; if operations permit, temporarily disable form submission functionality. Within 7 days: Implement Web Application Firewall rules blocking form injection payloads; deploy file integrity monitoring on wp-config.php and critical WordPress files; restrict administrative form viewing access to essential personnel only. Within 30 days: Monitor vendor advisory channels for patch availability; evaluate alternative form plugins; conduct forensic analysis of form entries and access logs for exploitation indicators; restore from clean backups if compromise suspected.

Contact Form Entries CVE-2026-9843

EUVD-2026-38104 HIGH

Path Traversal (CWE-22)

2026-06-20 Wordfence

GHSA-m735-jrv9-j3fc

PHP WordPress RCE Path Traversal Database For Contact Form 7 Wpforms Elementor Forms Wordpress Plugin Crmperks

8.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable form submission with no auth (AV:N/PR:N), but deletion only fires when an admin views the entry (UI:R); arbitrary file deletion yields I:H/A:H with no direct read (C:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 20, 2026 - 02:00 vuln.today

CVE Published

Jun 20, 2026 - 01:27 cve.org

HIGH 8.1

DescriptionCVE.org

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file.

AnalysisAI

Arbitrary file deletion in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions ≤1.5.1) allows remote unauthenticated attackers to poison form entries with traversal payloads that, when later viewed by an administrator, delete arbitrary server files and can be escalated to remote code execution by removing wp-config.php. Reported by Wordfence with publicly available exploit code exists via the Wordfence advisory; no public exploit identified at time of analysis as weaponized in-the-wild attacks, and the issue is not in CISA KEV.

Technical ContextAI

The plugin (CPE cpe:2.3:a:crmperks:database_for_contact_form_7,_wpforms,_elementor_forms) stores user-submitted form entries and exposes a view_page handler that calls a file deletion routine on entry attachments. The root cause is CWE-22 (Path Traversal) compounded by a PHP-specific parser quirk: PHP's bracket notation in $_POST/$_GET keys (e.g. names containing '[' or '.') is normalized into nested arrays, so an attacker-crafted JSON key reshapes into a structure that bypasses the isset() check on the stored sanitized path while still resolving to a traversal-controlled filesystem path inside the unlink() call. Affected source paths include includes/plugin-pages.php:1197, contact-form-entries.php:747 and :435, includes/data.php:539, and templates/view.php:559.

RemediationAI

Upstream fix available (changeset 3578556); released patched version not independently confirmed beyond '> 1.5.1', so administrators should update the Contact Form Entries plugin to the latest available release from the WordPress.org plugin repository as soon as it is published and verify the installed version is greater than 1.5.1. Until the update is applied, deactivate the plugin or restrict the wp-admin entry-viewing screens (the view_page handler) via web-server ACLs or a WAF rule that blocks form submissions containing bracket characters or '../' sequences in field names, accepting the trade-off that legitimate admins cannot triage entries while the rule is active; additionally, take a full backup of wp-config.php and the webroot so that an attacker-triggered deletion cannot be silently followed by a re-installation hijack. Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/4169b390-0972-4aa9-ae04-f5f67afe15ef?source=cve) and the patched code at https://plugins.trac.wordpress.org/changeset/3578556/contact-form-entries for indicators of compromise in stored form entries.