CVE-2026-107652 arshidkv12 CVE debrief

Who should care

WordPress administrators and users of the Database Addon for Contact Form 7 – CFDB7 plugin should assess their exposure and take necessary actions to prevent exploitation. This includes reviewing and updating the plugin, implementing additional security measures, and monitoring plugin logs for suspicious activity. Affected operators, platforms, vulnerability-management teams, and security teams should prioritize this vulnerability and take immediate action

Why it matters

CVE-2026-107652 is a medium-severity vulnerability in the Database Addon for Contact Form 7 – CFDB7 plugin for WordPress, allowing unauthenticated attackers to delete arbitrary files. WordPress administrators and users of the plugin should assess their exposure and take necessary actions to prevent exploitation.

• Unauthenticated attackers can delete arbitrary files
• Potential data loss or corruption
• Increased risk of website compromise

Technical summary

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath().

Defensive priority

Medium

Recommended defensive actions

• Review and update the Database Addon for Contact Form 7 – CFDB7 plugin to version greater than 1.4.1
• Implement additional security measures to restrict file deletion capabilities
• Monitor plugin logs for suspicious file deletion activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the plugin storing arbitrary submission fields and not properly validating file deletions. The process_bulk_action() delete handler matches any stored key containing 'cfdb7_file' and passes the stored value to unlink() without validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.