CVE-2026-107652: arshidkv12 database addon for contact form 7 – cfdb7

Vulnerability summary

CVE-2026-107652 is a medium (CVSS 5.3) vulnerability in arshidkv12 database addon for contact form 7 – cfdb7. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22% of scored vulnerabilities. Fixed in 1.4.2.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.