CVE-2026-107652: Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field
The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7forms row and the processbulkaction() delete handler then matching any stored key whose name contains the substring 'cfdb7file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. The attack requires sending a crafted multipart submission field whose name contains the substring "cfdb7_file".
What files can be deleted?
The vulnerable delete handler passes the stored field value directly to unlink() without verifying that the file belongs to the submission or constraining the path with basename() or realpath(). The provided data describes this as limited file deletion, but does not define the exact filesystem locations or files reachable.
Are default installations affected?
Affected installations are those running CFDB7 Database Addon for Contact Form 7 version 1.4.1 or earlier. The description does not identify any configuration prerequisite beyond the plugin handling the crafted submission data.
How can I determine whether an installation is vulnerable?
Check the installed CFDB7 plugin version. Versions up to and including 1.4.1 are affected according to the provided information.