Junglewise Threat Intelligence

CVE-2026-9843: crmperks Database for Contact Form 7 arbitrary file deletion in view_page

CVE-2026-9843 · Severity: high · CVSS 8.1 · Published 2026-06-20

Executive brief

A popular WordPress plugin used to store and manage contact form submissions is vulnerable to a flaw that allows attackers to delete critical website files. By submitting a malicious form entry, an attacker can trick the system into deleting the site's configuration file when an administrator views the entry. This can lead to a complete takeover of the website or a total service outage.

Technical details

The vulnerability is a path traversal flaw (CWE-22) located in the view_page function of the Database for Contact Form 7, WPforms, Elementor forms plugin. It stems from insufficient validation of file paths when processing form entries. An unauthenticated attacker can submit a poisoned form entry containing a crafted JSON key. When an administrator views or edits this entry, PHP's bracket parser reshapes the key to bypass 'isset' checks, triggering the deletion of a file specified via traversal (e.g., wp-config.php). Deleting the configuration file can allow an attacker to reset the site and achieve remote code execution. The issue affects all versions up to and including 1.5.1.

Affected products

  • crmperks Database for Contact Form 7, WPforms, Elementor forms up to, and including, 1.5.1

Timeline

  • 2026-06-20: advisory: NVD publication date

References