{"id":"CVE-2026-107652","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-107652","generatedAt":"2026-10-28T03:59:06.875Z","title":"The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1.","description":"The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.","published":"2026-10-14T02:16:57.000Z","lastModified":"2026-10-15T17:17:13.000Z","status":"Deferred","sourceIdentifier":"security@wordfence.com","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"cwe":["CWE-639"],"affected":[],"epss":{"score":0.00307,"percentile":0.23327,"date":"2026-10-27","history":[{"date":"2026-10-14","score":0.00307,"percentile":0.21854}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-14T02:16:57.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-10-14T02:16:57.297Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.4.0/contact-form-cfdb-7.php#L170","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.4.0/inc/admin-subpage.php#L325","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.4.0/inc/admin-subpage.php#L329","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3737068%40contact-form-cfdb7&new=3737068%40contact-form-cfdb7","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de3606a-254c-4e5f-9499-b1cc79dce7c8?source=cve","source":"security@wordfence.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-107652","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}