CVE-2026-6455 Cross-site request forgery in WP Contact Form 7 DB Handler
A CSRF vulnerability in WP Contact Form 7 DB Handler allows attackers to delete arbitrary files via SQL injection and deserialization flaws.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-6455?
CVE-2026-6455 is a high-severity vulnerability in yudiz WP Contact Form 7 DB Handler, published on 28 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via SQL Injection and PHP Object Injection in versions up to and including 3.0. This is due to a missing nonce verification in the process_bulk_action() function, the nonce check is only executed when _wpnonce is present in the POST body, allowing it to be trivially bypassed by omitting the field, combined with the use of an unsanitized, unparameterized user-supplied value in a numeric SQL context (WHERE ID = $ID) and the unsafe deserialization of the query result's post_content field. An attacker can craft a CSRF page that tricks a logged-in administrator into triggering a UNION-based SQL injection payload (using CHAR() to avoid esc_sql quote-escaping) that returns a malicious serialized PHP array as post_content; upon deserialization, array values associated with keys containing 'ys_cfdbh_file' are used as file paths appended to the uploads directory path without any path traversal validation, and then passed to wp_delete_file(), allowing the attacker to delete arbitrary files on the server (e.g., wp-config.php, system files).
Weakness: CWE-352
Which versions are affected by CVE-2026-6455?
How do I fix CVE-2026-6455?
No fix has been published for CVE-2026-6455 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-6455 being exploited?
There is no known exploitation of CVE-2026-6455 in the wild and no public exploit code.
Sources
Also known as GHSA-xf5m-7grh-3gvm.