Executive brief
A popular WordPress plugin used to store and manage contact form submissions is vulnerable to a flaw that allows attackers to delete critical website files. By submitting a malicious form entry, an attacker can trick the system into deleting the site's configuration file when an administrator views the entry. This can lead to a complete takeover of the website or a total service outage.
Technical details
The vulnerability is a path traversal flaw (CWE-22) located in the view_page function of the Database for Contact Form 7, WPforms, Elementor forms plugin. It stems from insufficient validation of file paths when processing form entries. An unauthenticated attacker can submit a poisoned form entry containing a crafted JSON key. When an administrator views or edits this entry, PHP's bracket parser reshapes the key to bypass 'isset' checks, triggering the deletion of a file specified via traversal (e.g., wp-config.php). Deleting the configuration file can allow an attacker to reset the site and achieve remote code execution. The issue affects all versions up to and including 1.5.1.
Affected products
- crmperks Database for Contact Form 7, WPforms, Elementor forms up to, and including, 1.5.1
Timeline
- 2026-06-20: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/contact-form-entries.php
- https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/contact-form-entries.php
- https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/includes/data.php
- https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/includes/plugin-pages.php
- https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/templates/view.php
- https://plugins.trac.wordpress.org/changeset/3578556/contact-form-entries
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4169b390-0972-4aa9-ae04-f5f67afe15ef?source=cve