Cross-Site Request Forgery in WP Contact Form 7 DB Handler Plugin by WordPress

CVE-2026-6455

What is CVE-2026-6455?

The WP Contact Form 7 DB Handler plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) exploitation, resulting in Arbitrary File Deletion through SQL Injection and PHP Object Injection vulnerabilities. This issue arises from inadequate nonce verification in the process_bulk_action() function, allowing attackers to bypass checks by omitting the _wpnonce field. By leveraging an unvalidated user-supplied value in a SQL context, an attacker could inject a malicious SQL command that is executed on behalf of a logged-in administrator, enabling the deletion of arbitrary files, including sensitive system files and configurations.

References