CVE-2026-6455: WP Contact Form 7 DB Handler CSRF Vulnerability

CVE-2026-6455 Overview

CVE-2026-6455 affects the WP Contact Form 7 DB Handler plugin for WordPress in versions up to and including 3.0. The vulnerability chains Cross-Site Request Forgery (CSRF) with SQL Injection and PHP Object Injection to achieve arbitrary file deletion on the server. An attacker who tricks a logged-in administrator into visiting a malicious page can delete critical files such as wp-config.php, which can disable the site or facilitate further compromise. The flaw is tracked under [CWE-352] and resides in the process_bulk_action() function of form-inner-page-class.php.

Critical Impact

Successful exploitation enables deletion of arbitrary server files, including wp-config.php, leading to site takeover when WordPress re-enters its setup flow on a missing configuration.

Affected Products

• WP Contact Form 7 DB Handler plugin for WordPress
• All versions up to and including 3.0
• WordPress sites with an authenticated administrator session

Discovery Timeline

• 2026-05-28 - CVE CVE-2026-6455 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-6455

Vulnerability Analysis

The vulnerability resides in the process_bulk_action() function within include/form-inner-page-class.php. The function attempts nonce verification only when the _wpnonce field is present in the POST body. An attacker bypasses the CSRF check entirely by omitting the field from the forged request. With the anti-CSRF control neutralized, the same handler passes a user-supplied identifier into a SQL query without sanitization or parameterization, forming the second link in the exploit chain.

The injected query returns a row whose post_content value is then passed through PHP's unserialize(). This unsafe deserialization allows the attacker to control the resulting array's structure. Array values bound to keys containing ys_cfdbh_file are appended to the WordPress uploads directory path and forwarded to wp_delete_file() without path traversal validation.

Root Cause

Three distinct defects compound into the file deletion primitive. First, conditional nonce verification creates a logic gap rather than enforcing a mandatory check. Second, the WHERE ID = $ID clause concatenates raw input into the SQL string, enabling UNION-based injection using CHAR() to evade esc_sql() quote escaping. Third, the plugin calls unserialize() on attacker-influenced query output and trusts the resulting file paths without canonicalization.

Attack Vector

An attacker hosts a CSRF page containing a crafted POST request targeting the plugin's bulk action endpoint. When a logged-in administrator loads the page, the browser submits the request without _wpnonce, bypassing the verification branch. The injected UNION SELECT payload returns a malicious serialized PHP array as post_content. Upon deserialization, values keyed with ys_cfdbh_file resolve to traversal paths such as ../../wp-config.php, which wp_delete_file() then removes from disk.

For exact source line references, see the WordPress Plugin Source - process_bulk_action and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-6455

Indicators of Compromise

• POST requests to WordPress admin endpoints for the WP Contact Form 7 DB Handler plugin that lack a _wpnonce parameter but include bulk action parameters.
• Request bodies containing SQL keywords such as UNION SELECT combined with CHAR( sequences in numeric ID parameters.
• Serialized PHP payloads referencing the ys_cfdbh_file key within HTTP request bodies or database records.
• Sudden absence of wp-config.php, theme files, or other critical files within the WordPress installation directory.

Detection Strategies

• Inspect web server and PHP access logs for cross-origin referrers preceding requests to plugin admin handlers.
• Alert on file deletion events targeting wp-config.php or files outside the wp-content/uploads/ directory by the PHP-FPM or web server process.
• Deploy a web application firewall rule that blocks requests containing UNION plus CHAR( in numeric parameters submitted to plugin endpoints.

Monitoring Recommendations

• Enable WordPress audit logging to capture bulk action requests, administrator session activity, and plugin configuration changes.
• Monitor file integrity for the WordPress root and wp-includes/ to detect unauthorized deletions in near real time.
• Track outbound HTTP referrers from administrator browsers to identify CSRF-triggering pages hosted externally.

How to Mitigate CVE-2026-6455

Immediate Actions Required

• Update the WP Contact Form 7 DB Handler plugin to a version newer than 3.0 once the vendor publishes a patched release.
• Deactivate and remove the plugin until a fixed version is available if it is not business-critical.
• Restrict administrator access to the WordPress admin panel using IP allowlisting or a VPN to reduce CSRF exposure.
• Audit the WordPress filesystem for missing core files and restore from backup if deletions are detected.

Patch Information

Vendor patch details are tracked in the WordPress Plugin Changeset. Site operators should confirm the installed plugin version reflects the changeset before treating the site as remediated.

Workarounds

• Configure the web application firewall to require a valid _wpnonce parameter on all administrative POST requests to the plugin.
• Block requests to WordPress admin URLs that contain SQL metacharacters or serialized PHP markers such as a: and s: in unexpected parameters.
• Apply strict SameSite=Lax or SameSite=Strict cookies on the WordPress session to limit cross-site request execution.
• Set filesystem permissions on wp-config.php and other critical files to deny write and unlink access by the PHP runtime user where feasible.

# Example WAF rule (ModSecurity) to block CSRF without nonce on plugin admin POSTs
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1026645501,msg:'CVE-2026-6455 - Missing nonce on plugin admin action'"
  SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
    "chain"
    SecRule ARGS:page "@contains cfdbh" \
      "chain"
      SecRule &ARGS_POST:_wpnonce "@eq 0"