CVE-2026-107652

Deferred Deferred - Pending Action

Arbitrary File Deletion in Database Addon for Contact Form 7 – CFDB7

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107652

EUVD

EUVD-2026-100766

Affected Vendors & Products

Vendor	Product	Version / Range
arshidkv12	Database	Addon for Contact Form 7 – CFDB7 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress has a vulnerability in versions up to 1.4.1 that allows arbitrary file deletion. The plugin stores submission fields in a database row and uses a delete handler that matches any stored key containing 'cfdb7_file'. It then passes the stored value directly to the unlink() function without validating if the file belongs to the submission or restricting the filename. This enables unauthenticated attackers to inject a crafted multipart field and delete arbitrary files.

Detection Guidance

To detect this vulnerability, check if the Database Addon for Contact Form 7 – CFDB7 plugin is installed and verify its version. If it is version 1.4.1 or lower, it is vulnerable. Look for unauthorized file deletions or suspicious activity in server logs related to the plugin.

Impact Analysis

This vulnerability allows unauthenticated attackers to delete arbitrary files on the server where the WordPress site is hosted. This could lead to data loss, disruption of services, or compromise of sensitive information if critical files are deleted. Attackers might also leverage this to escalate privileges or further compromise the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized deletion or exposure of personal or sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A successful exploit could violate these regulations, leading to legal penalties or reputational damage.

Mitigation Strategies

Immediately update the Database Addon for Contact Form 7 – CFDB7 plugin to the latest version to patch the Arbitrary File Deletion vulnerability. If an update is not available, consider disabling or removing the plugin until a fix is released.

Hi! I’m here to help you understand CVE-2026-107652. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70