CVE-2026-107652: CFDB7 WordPress Plugin Path Traversal Flaw

CVE-2026-107652 Overview

CVE-2026-107652 affects the Database Addon for Contact Form 7 (CFDB7), a WordPress plugin that stores form submissions in the database. Versions up to and including 1.4.1 contain an arbitrary file deletion flaw tied to how the plugin handles submission metadata. The plugin stores non-form-tag submission fields in the db7_forms row, and its process_bulk_action() delete handler passes any stored key containing the substring cfdb7_file directly to unlink(). The handler does not validate ownership of the file or constrain the path with basename() or realpath(). Unauthenticated attackers can inject a crafted multipart field to trigger deletion of arbitrary files on the server when a submission is later deleted.

Critical Impact
Unauthenticated attackers can plant arbitrary file paths in form submissions that are later deleted by administrators, resulting in deletion of files outside the intended uploads directory.

Affected Products

Database Addon for Contact Form 7 (CFDB7) WordPress plugin
All versions up to and including 1.4.1
WordPress sites processing CFDB7 form submissions

Discovery Timeline

2026-10-14 - CVE CVE-2026-107652 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107652

Vulnerability Analysis

The vulnerability is categorized as Authorization Bypass Through User-Controlled Key [CWE-639]. The CFDB7 plugin captures every multipart field submitted through a Contact Form 7 form and persists it as part of the db7_forms database row, without filtering fields down to those declared in the form shortcode. When an administrator later deletes a submission through the plugin's admin interface, process_bulk_action() iterates over stored keys and treats any key whose name contains cfdb7_file as a reference to an uploaded attachment. The stored value is passed directly to unlink() on the filesystem.

Because the stored value originates from attacker-controlled input and is never normalized, an attacker can submit a field such as cfdb7_file_evil containing an absolute path or traversal sequence. When the submission is deleted, the plugin removes the referenced file. Impact is limited to file deletion, so the direct consequences are integrity and availability loss. However, deleting files such as wp-config.php can place the site into installation mode, which enables account takeover scenarios in follow-on exploitation.

Root Cause

The root cause is twofold. First, the submission handler accepts and persists arbitrary multipart field names rather than restricting storage to form-tag fields. Second, the delete routine performs substring matching on key names and trusts the stored value as a legitimate upload path. Neither basename() nor realpath() is used to constrain the file to the plugin's upload directory, and no check verifies that the file was created by the submission being deleted.

Attack Vector

Exploitation requires no authentication. An attacker submits a multipart form POST to a page that renders a CFDB7-enabled Contact Form 7 form. The POST includes an attacker-chosen field name containing the substring cfdb7_file and a value set to the absolute or relative path of the target file. The record persists in db7_forms until an administrator performs a bulk delete, at which point the plugin invokes unlink() on the attacker-supplied path. Full technical analysis is available in the Wordfence Vulnerability Report and the vulnerable code is referenced in the WordPress Plugin Source Code.

Detection Methods for CVE-2026-107652

Indicators of Compromise

Entries in the db7_forms table containing field keys that include the substring cfdb7_file but do not correspond to a file tag in the form definition.
Stored field values that contain absolute paths, path traversal sequences such as ../, or references to sensitive files such as wp-config.php or .htaccess.
Missing or recently deleted WordPress core, plugin, or configuration files following a CFDB7 submission deletion event.
Web server access logs showing multipart POSTs to CF7 endpoints with unusually named file fields from unauthenticated sources.

Detection Strategies

Query the db7_forms table for suspicious keys and inspect their values against the expected form schema.
Compare file integrity baselines before and after administrator cleanup of CFDB7 submissions to identify unexpected deletions.
Review PHP error logs for unlink() warnings on paths outside the plugin's intended upload directory.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress root, wp-admin, wp-includes, and the active theme and plugin directories.
Log all administrator actions in the CFDB7 submissions interface, including the fields present in each deleted record.
Alert on web requests posting multipart form fields with names matching the pattern *cfdb7_file* that do not map to legitimate form upload fields.

How to Mitigate CVE-2026-107652

Immediate Actions Required

Upgrade the Database Addon for Contact Form 7 (CFDB7) plugin to a version later than 1.4.1 as soon as a patched release is available.
Audit existing db7_forms entries and remove any records containing unexpected keys matching *cfdb7_file* before deleting submissions through the admin UI.
Restrict access to the WordPress admin so bulk delete operations cannot be triggered on untrusted submission data without review.

Patch Information

The plugin maintainers published a code change tracked in the WordPress Plugin Changeset. Administrators should update to the fixed release through the WordPress plugin management interface or by replacing the plugin directory on disk. Confirm the installed version is greater than 1.4.1 after upgrade.

Workarounds

Deactivate the CFDB7 plugin until a patched version is installed if updates cannot be applied immediately.
Avoid bulk deleting CFDB7 submissions received from unauthenticated users while vulnerable code is still active.
Place the webroot on a filesystem user whose write and delete permissions exclude WordPress core and configuration files where feasible.

bash

# Configuration example
# Identify suspicious CFDB7 submission fields in the database
wp db query "SELECT form_id, form_date, form_value FROM wp_db7_forms WHERE form_value LIKE '%cfdb7_file%';"

# After confirming suspicious entries, remove them before admin cleanup
wp db query "DELETE FROM wp_db7_forms WHERE form_value LIKE '%../%' OR form_value LIKE '%wp-config%';"

# Verify installed plugin version
wp plugin get contact-form-cfdb7 --field=version