CVE-2026-120559: Path Traversal
The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefdremoveuploadedfile() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wplocalizescript and is therefore retrievable by any unauthenticated visitor.
Event History
Frequently Asked Questions
Which installations are affected?
WordPress sites using Contact Form Extender for Divi Builder version 1.0.6 or earlier are affected. Version 1.0.7 is referenced as containing a later implementation of the vulnerable file.
Does exploitation require an account or interaction from a victim?
No. The vulnerable AJAX action can be reached by unauthenticated attackers, and its nonce is available in public page source through wp_localize_script. No privileges or user interaction are required.
What could an attacker do with this issue?
An attacker can delete arbitrary files on the server because file paths are insufficiently validated. Deletion of a sensitive file such as wp-config.php can potentially lead to remote code execution.