CVE-2026-107652 Details
Description
The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.
A vulnerability allowing arbitrary file deletion has been identified in the Database Addon for Contact Form 7 – CFDB7 plugin for WordPress, affecting versions through 1.4.1. The issue arises because the plugin saves arbitrary submission fields, not limited to form tags, in its db7_forms database row. The process_bulk_action() delete handler then targets any stored key containing 'cfdb7_file', passing the associated value directly to the unlink() function. This process lacks validation to ensure the file belongs to the submission being deleted and does not properly constrain the filename using basename() or realpath(). As a result, unauthenticated attackers can inject a crafted multipart field to exploit this vulnerability.
Users are advised to update the Database Addon for Contact Form 7 – CFDB7 to version 1.4.2 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Database Addon for Contact Form 7 | <= 1.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |