CVE-2026-107652 Path traversal in Database Addon for Contact Form 7 – CFDB7
Unauthenticated attackers can delete arbitrary files on the server by injecting a crafted field into the CFDB7 plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107652?
CVE-2026-107652 is a medium-severity path traversal vulnerability in arshidkv12 Database Addon for Contact Form 7 – CFDB7, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.
Weakness: CWE-639
Which versions are affected by CVE-2026-107652?
How do I fix CVE-2026-107652?
No fix has been published for CVE-2026-107652 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-107652 being exploited?
There is no known exploitation of CVE-2026-107652 in the wild and no public exploit code.
Sources
Also known as GHSA-5c8v-v24f-7rj6.