CVE-2026-120559

The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wp_localize_script and is therefore retrievable by any unauthenticated visitor.

• CWE-22

• https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.3/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L159
• https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.3/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L18
• https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.7/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L166
• https://plugins.trac.wordpress.org/changeset?old_path=contact-form-extender-for-divi-builder%2Ftags%2F1.0.6&new_path=contact-form-extender-for-divi-builder%2Ftags%2F1.0.7
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3499767%40contact-form-extender-for-divi-builder%2Ftrunk&old=3499766%40contact-form-extender-for-divi-builder%2Ftrunk&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/contact-form-extender-for-divi-builder/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7bbead7c-47b9-473f-b335-6fae4b5998d6?source=cve

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120544The Academy LMS – AI Course Builder, Quizzes, Certificates &…4.3
• CVE-2026-120551The WP Compress – Instant Performance & Speed Optimization p…5.3
• CVE-2026-120552The SEO Engine – Smart SEO with AI, Schema & Redirection for…6.4
• CVE-2026-120553The Customer Reviews for WooCommerce plugin for WordPress is…6.4
• CVE-2026-120554The Import and export users and customers plugin for WordPre…8.8
• CVE-2026-120558The Advanced Shipment Tracking for WooCommerce plugin for Wo…7.2
• CVE-2026-120561The JetFormBuilder — Dynamic Blocks Form Builder plugin for …5.3
• CVE-2026-120563The WooCommerce Multilingual & Multicurrency with WPML plugi…4.9
• CVE-2026-120567The MongoDB Entity Framework Core provider does not neutrali…5.4
• CVE-2026-12057When the application executes the JavaScript script embedded…7.8
• CVE-2026-120572Incorrect boundary conditions in the Layout: Block and Inlin…8.8
• CVE-2026-120574The SureCart plugin for WordPress is vulnerable to unauthent…8.1