Database Addon For Contact Form 7 Cfdb7
Monthly
Arbitrary file deletion in the Database Addon for Contact Form 7 - CFDB7 WordPress plugin through version 1.4.1 allows unauthenticated attackers to inject a crafted multipart submission field whose name contains the substring 'cfdb7_file' and whose value is an arbitrary filesystem path; the plugin stores that non-form-tag field and later passes it to unlink() without basename()/realpath() normalisation or any check that the file belongs to that submission. Because deletion does not occur at submission time but only when an administrator bulk-deletes the poisoned entry from wp-admin, successful exploitation depends on privileged operator interaction, which is why the independent assessment rates it CVSS 5.3 (MEDIUM) with UI:R while retaining PR:N and network reachability. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Arbitrary file deletion in the Database Addon for Contact Form 7 - CFDB7 WordPress plugin through version 1.4.1 allows unauthenticated attackers to inject a crafted multipart submission field whose name contains the substring 'cfdb7_file' and whose value is an arbitrary filesystem path; the plugin stores that non-form-tag field and later passes it to unlink() without basename()/realpath() normalisation or any check that the file belongs to that submission. Because deletion does not occur at submission time but only when an administrator bulk-deletes the poisoned entry from wp-admin, successful exploitation depends on privileged operator interaction, which is why the independent assessment rates it CVSS 5.3 (MEDIUM) with UI:R while retaining PR:N and network reachability. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).