Arbitrary File Deletion Vulnerability in Contact Form Extender for Divi Builder Plugin by WordPress

CVE-2026-120559

What is CVE-2026-120559?

The Contact Form Extender for Divi Builder plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to delete arbitrary files from the server. This is due to inadequate file path validation in the cfefd_remove_uploaded_file() function. The nonce used for protecting this AJAX action is visible in the public page source, making it accessible to any visitor. If critical files like wp-config.php are deleted, this can lead to severe security breaches including remote code execution.

References