CVE-2026-9145: WordPress Plugin Path Traversal Vulnerability

CVE-2026-9145 Overview

CVE-2026-9145 is an arbitrary file copy vulnerability in the Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress. The flaw affects all versions up to and including 1.5.1. The create_entry_el() function reads the raw_value from Elementor Pro's Form_Record object for upload-type fields and passes it directly to PHP's copy() without validating that the value corresponds to a legitimately uploaded file. Unauthenticated attackers can supply arbitrary local paths or remote URLs to disclose files readable by the PHP process. The vulnerability is classified under [CWE-22] path traversal.

Critical Impact
Unauthenticated attackers can copy arbitrary local files or attacker-controlled remote content onto the server through the vulnerable create_entry_el() handler.

Affected Products

Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress
Versions up to and including 1.5.1
Requires Elementor Pro to be installed as a prerequisite for triggering the vulnerable code path

Discovery Timeline

2026-07-02 - CVE-2026-9145 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-9145

Vulnerability Analysis

The vulnerability resides in the create_entry_el() handler inside the Contact Form Entries plugin. This function is invoked through the elementor_pro/forms/new_record hook owned by Elementor Pro. When the handler processes upload-type form fields, it reads the raw_value property from the Form_Record object and passes it directly to PHP's copy() function.

The handler never verifies that the value corresponds to a real entry in the $_FILES superglobal. When no file is actually uploaded, raw_value reflects whatever string the attacker submitted in the POST body. PHP's copy() function accepts both local filesystem paths and URL sources, giving attackers broad control over the source parameter.

Although the destination is a hashed directory intended to obscure the copied file, the hash is generated from uniqid() and rand(). These are non-cryptographic sources and should not be treated as a security boundary.

Root Cause

The root cause is missing input validation on user-supplied form field values before they are used as a source path in a file copy operation. The plugin trusts raw_value as if it always represented an uploaded file, but Elementor Pro's Form_Record object populates this field from POST data when $_FILES is empty. The absence of an existence or origin check on the source parameter permits path traversal and remote URL retrieval.

Attack Vector

An unauthenticated attacker submits a crafted POST request to an Elementor Pro form on a vulnerable site. The attacker sets an upload-type field to a target path such as /etc/passwd, wp-config.php, or a remote URL under attacker control. The handler calls copy() on that value, writing the file into a directory under the WordPress uploads folder. Because the destination directory uses a weakly generated hash, brute-force or timing techniques may aid retrieval. Details of the vulnerable code paths are available in the WordPress Plugin Code Reference and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-9145

Indicators of Compromise

Unexpected files appearing under the WordPress wp-content/uploads/ directory with hashed subdirectory names created shortly after unauthenticated form submissions
Web server access logs showing POST requests to Elementor Pro form endpoints containing local filesystem paths or external URLs in upload field parameters
PHP error logs referencing copy() calls with sources such as /etc/passwd, wp-config.php, or http:// and https:// URLs
Outbound HTTP requests from the web server to unfamiliar hosts triggered by form submissions

Detection Strategies

Monitor POST bodies submitted to Elementor Pro form endpoints for path traversal sequences (../) and absolute filesystem paths in fields typed as file uploads
Alert on PHP file operations where the source argument to copy() originates from HTTP request data rather than the $_FILES array
Correlate form submissions on WordPress sites running vulnerable versions of the Contact Form Entries plugin with new file creations under the uploads directory

Monitoring Recommendations

Enable WordPress audit logging for plugin activity and form submissions on sites running Elementor Pro alongside Contact Form Entries
Track outbound network connections initiated by the PHP-FPM or web server process to identify remote URL fetches invoked by copy()
Review the plugin version reported by WordPress and flag any installation of Contact Form Entries at 1.5.1 or earlier

How to Mitigate CVE-2026-9145

Immediate Actions Required

Update the Database for Contact Form 7, WPforms, Elementor forms plugin to a version later than 1.5.1 as soon as a patched release is available
Audit the WordPress uploads directory for unexpected hashed subdirectories containing files not associated with legitimate form submissions
Rotate any secrets stored in files that may have been readable by the PHP process, such as wp-config.php database credentials and API keys

Patch Information

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for tracking of the fix. Apply the vendor-supplied update through the WordPress plugin management interface once released.

Workarounds

Deactivate the Contact Form Entries plugin until a patched version is installed, particularly on sites also running Elementor Pro
Restrict outbound network access from the web server to prevent remote URL retrieval through PHP's copy() wrappers
Set the PHP configuration directive allow_url_fopen=Off to block URL-based sources in file operations where feasible
Deploy a web application firewall rule to reject POST parameters containing filesystem paths or URL schemes in Elementor Pro form upload fields

bash

# Configuration example: disable URL-based file operations in php.ini
allow_url_fopen = Off
allow_url_include = Off