CVE-2026-107652

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 1.4.1 . The root cause is that the plugin stores arbitrary submission fields in its db7_forms row. The process_bulk_action() delete handler matches any store...

EUVD-2026-100766

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

WordPress Database Addon for Contact Form 7 – CFDB7 plugin <= 1.4.1 - Unauthenticated Limited File Deletion vulnerability

Unauthenticated Limited File Deletion vulnerability discovered by Sawyer in WordPress Plugin Contact Form 7 Database Addon – CFDB7 versions = 1.4.1...