Arbitrary File Deletion in Database Addon for Contact Form 7 by WordPress

CVE-2026-107652

What is CVE-2026-107652?

The Database Addon for Contact Form 7 plugin for WordPress is susceptible to an Arbitrary File Deletion vulnerability. This arises due to improper handling of arbitrary file submissions, where the plugin saves non-form-tag fields in its db7_forms database row. The delete function, process_bulk_action(), incorrectly processes these fields, allowing unauthenticated attackers to manipulate input and inject crafted multipart fields. This results in the capability to delete files without appropriate validation, posing significant security risks to users.

References