{"id":"CVE-2026-107652","aliases":["EUVD-2026-100766","GHSA-5c8v-v24f-7rj6"],"status":"published","title":"Database Addon for Contact Form 7 \u003c= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field","description":"The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00307,"percentile":0.23656,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-10-14T01:27:14Z","modified":"2026-10-15T17:17:13Z","products":[{"vendor":"arshidkv12","product":"database addon for contact form 7 – cfdb7"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de3606a-254c-4e5f-9499-b1cc79dce7c8?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.4.0/inc/admin-subpage.php#L329"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.4.0/inc/admin-subpage.php#L325"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.4.0/contact-form-cfdb-7.php#L170"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3737068%40contact-form-cfdb7\u0026new=3737068%40contact-form-cfdb7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107652"},{"url":"https://github.com/advisories/GHSA-5c8v-v24f-7rj6"}],"sources":{"cve":[{"id":"CVE-2026-107652","title":"Database Addon for Contact Form 7 \u003c= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field","description":"The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.","status":"published","published":"2026-10-14T01:27:14.328Z","modified":"2026-10-15T16:43:51.315Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-100766","description":"The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.","status":"published","published":"2026-10-14T01:27:14Z","modified":"2026-10-15T16:43:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:00:11.901066Z"}],"ghsa":[{"id":"GHSA-5c8v-v24f-7rj6","title":"The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary...","description":"The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.","status":"published","published":"2026-10-14T03:30:38Z","modified":"2026-10-14T03:30:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2026-107652","description":"The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.","status":"published","published":"2026-10-14T02:16:57.297Z","modified":"2026-10-15T17:17:13.2Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:58.630796Z"}]}}