Contact Form Extender For Divi Submissions Db Extra Fields
Monthly
Unauthenticated arbitrary file deletion in the WordPress plugin Contact Form Extender for Divi Builder (Submissions DB & Extra Fields) affects every version up to and including 1.0.6: the AJAX handler cfefd_remove_uploaded_file() takes an attacker-supplied path without adequate validation (CWE-22), and the nonce meant to guard that action is printed into the public page source by wp_localize_script, so any anonymous visitor viewing a page that renders the file-upload module can obtain it. Successful abuse lets an attacker unlink arbitrary server-side files, and deleting a sensitive file such as wp-config.php can quickly escalate into remote code execution or a full site takeover. No public exploit code or active exploitation is identified at time of analysis, and there is no KEV listing; the Wordfence-reported issue is prioritised as a fix-this-week item, with urgency bounded by the plugin's install footprint and by whether a publicly reachable page emits the nonce. The vendor correction is version 1.0.7.
Unauthenticated arbitrary file deletion in the WordPress plugin Contact Form Extender for Divi Builder (Submissions DB & Extra Fields) affects every version up to and including 1.0.6: the AJAX handler cfefd_remove_uploaded_file() takes an attacker-supplied path without adequate validation (CWE-22), and the nonce meant to guard that action is printed into the public page source by wp_localize_script, so any anonymous visitor viewing a page that renders the file-upload module can obtain it. Successful abuse lets an attacker unlink arbitrary server-side files, and deleting a sensitive file such as wp-config.php can quickly escalate into remote code execution or a full site takeover. No public exploit code or active exploitation is identified at time of analysis, and there is no KEV listing; the Wordfence-reported issue is prioritised as a fix-this-week item, with urgency bounded by the plugin's install footprint and by whether a publicly reachable page emits the nonce. The vendor correction is version 1.0.7.