CVE-2026-9843 Details

A vulnerability allowing unauthenticated arbitrary file deletion has been identified in the WordPress Contact Form Entries plugin, specifically in versions through 1.5.1. This issue arises from inadequate file path validation in the 'view_page' function, which can be exploited to delete arbitrary files on the server. The vulnerability could lead to remote code execution if a critical file, such as 'wp-config.php', is deleted. Exploitation requires an administrator to access or modify the affected form entry, allowing the attacker to manipulate the JSON data to bypass security checks and trigger the deletion.

Users are advised to update the Contact Form Entries plugin to version 1.5.2 or later, where this vulnerability has been patched.