CFDB7 EUVD-2026-100766

Exploitation requires the CFDB7 Database Addon (≤1.4.1) to be active with a Contact Form 7 form that stores submissions. The unauthenticated attacker must send a multipart submission containing an injected field whose name includes the substring 'cfdb7_file' and whose value is a filesystem path; the plugin stores this arbitrary non-form-tag field and later passes it to unlink() without basename()/realpath() validation or ownership checks. The critical LIMITING factor is that deletion does not fire at submission time - it only executes when a site administrator deletes that stored submission via the admin bulk-action handler, so successful exploitation depends on privileged operator interaction. No special server configuration is otherwise required.

This is a CVSS 5.3 (MEDIUM) issue, and the signals collectively argue for measured, not urgent, prioritization. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms network vector, low complexity, and no privileges - hence the unauthenticated framing. However, the description itself reveals a conflict with the UI:N rating: the dangerous unlink() occurs inside the admin process_bulk_action() delete handler, meaning the unauthenticated attacker can only STAGE the payload (inject a crafted multipart field stored in db7_forms), while actual file deletion fires only when a site administrator later deletes that submission. This deferred, operator-triggered execution materially lowers real-world likelihood versus a fully self-contained unauthenticated exploit. No EPSS score, no SSVC decision data, and no KEV listing were provided, and the report originates from Wordfence research rather than observed attacks - so there is no public exploit identified at time of analysis. Impact is rated I:L / A:N, but note that arbitrary file deletion can be escalated: deleting wp-config.php can force WordPress into its setup/reinstall flow and enable full site takeover, so the practical integrity/availability impact may exceed the base I:L rating - verify against deployment. Net: a real but conditional flaw worth patching on normal cadence, not an emergency.

An attacker submits a crafted multipart POST to a public CFDB7-backed Contact Form 7 form, adding an extra field whose name contains the substring 'cfdb7_file' and whose value is the absolute path of a sensitive file (e.g. wp-config.php). The malicious value is stored verbatim in the db7_forms row. When a site administrator later reviews and bulk-deletes that spam-looking submission, the plugin passes the attacker-controlled path straight to unlink(), deleting the targeted file. No public exploit code is identified at time of analysis.