Junglewise Threat Intelligence

CVE-2026-9145: crmperks Contact Form Entries arbitrary file copy in create_entry_el

CVE-2026-9145 · Severity: medium · CVSS 6.5 · Published 2026-07-02

Executive brief

A WordPress plugin used to store and manage contact form submissions is vulnerable to a security flaw that allows unauthorized users to copy sensitive files. By manipulating form submission data, an attacker could potentially access internal server files or download remote malicious content onto the website's server. This could lead to the exposure of confidential configuration data or site credentials, though the attacker must first identify the specific location where the copied files are stored.

Technical details

The vulnerability exists in the create_entry_el() function of the Contact Form Entries plugin (versions up to 1.5.1) due to improper validation of the raw_value field from Elementor Pro's Form_Record object. When an upload-type field is processed and no file is present in $_FILES, the plugin passes an attacker-controlled POST string directly to PHP's copy() function. Because copy() supports both local paths and remote URLs, an unauthenticated attacker can trigger the copying of arbitrary local files or remote content to a directory on the server. While the destination directory name is hashed using non-cryptographic methods (uniqid and rand), successful exploitation allows for arbitrary file disclosure if the destination path is discovered. Elementor Pro must be active to trigger the affected code path.

Affected products

  • crmperks Database for Contact Form 7, WPforms, Elementor forms (Contact Form Entries) <= 1.5.1

Timeline

  • 2026-07-02: disclosed
  • 2026-07-02: advisory

References