CVE-2026-9843— Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
Possible ATT&CK Techniques 3AI
T1105 · Ingress Tool Transfer T1059 · Command and Scripting Interpreter T1485 · Data DestructionGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9843
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| crmperks | Database for Contact Form 7, WPforms, Elementor forms | 0 ~ 1.5.1 | - |
II. Public POCs for CVE-2026-9843
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9843
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-9843 (2)
Other References for CVE-2026-9843 (1)
IV. Related Vulnerabilities
Same product: Database for Contact Form 7, WPforms, Elementor forms
- CVE-2026-9145
Database for Contact Form 7, WPforms, Elementor forms <= 1.5 - CVE-2026-3831
Database for Contact Form 7, WPforms, Elementor forms <= 1.4 - CVE-2026-2599
Database for Contact Form 7, WPforms, Elementor forms <= 1.4 - CVE-2026-0825
Database for Contact Form 7, WPforms, Elementor forms <= 1.4 - CVE-2025-7384
Database for Contact Form 7, WPforms, Elementor forms <= 1.4
Same vendor: crmperks
- CVE-2026-9145
Database for Contact Form 7, WPforms, Elementor forms <= 1.5 - CVE-2026-3831
Database for Contact Form 7, WPforms, Elementor forms <= 1.4 - CVE-2026-2599
Database for Contact Form 7, WPforms, Elementor forms <= 1.4 - CVE-2026-2568
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidabl - CVE-2026-0825
Database for Contact Form 7, WPforms, Elementor forms <= 1.4
Same weakness: CWE-22
- CVE-2026-41124
Dell PowerProtect 数据目录穿越漏洞 - CVE-2026-47896
Apache Lucene.Net: Unauthenticated arbitrary file read on th - CVE-2026-47897
Apache Lucene.Net: Arbitrary file write from malicious serve - CVE-2026-9725
Printcart Web to Print Product Designer for WooCommerce <= 2 - CVE-2026-14352
AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal
V. Comments for CVE-2026-9843
No comments yet