Arbitrary File Deletion Vulnerability in Contact Form 7 Plugin for WordPress

CVE-2025-8141

What is CVE-2025-8141?

The Contact Form 7 plugin for WordPress exhibits a security weakness allowing arbitrary file deletion due to inadequate validation of file paths in the delete_associated_files function. This vulnerability affects all versions up to and including 3.2.4, enabling unauthenticated attackers to delete any file on the server. Such actions can lead to severe consequences, including the potential for remote code execution, particularly if sensitive files like wp-config.php are targeted.

References