Arbitrary File Deletion Vulnerability in Contact Form Plugins for WordPress

CVE-2026-9843

What is CVE-2026-9843?

A significant vulnerability exists in multiple WordPress contact form plugins that allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation in the view_page function. When an administrator views or edits a tampered form entry, the vulnerability enables attackers to craft specific JSON keys that bypass security checks, facilitating file deletion. This can potentially lead to serious consequences, including remote code execution if critical files such as wp-config.php are targeted.

References