CVE-2026-9843

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file.

• CWE-22

• https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/contact-form-entries.php#L435
• https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/contact-form-entries.php#L747
• https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/includes/data.php#L539
• https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/includes/plugin-pages.php#L1197
• https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.5.1/templates/view.php#L559
• https://plugins.trac.wordpress.org/changeset/3578556/contact-form-entries
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4169b390-0972-4aa9-ae04-f5f67afe15ef?source=cve

Published

Jun 20, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9831A race condition in the shared Extreme Platform ONE IAM Gate…6.3
• CVE-2026-9833The Tag Groups is the Advanced Way to Display Your Taxonomy …7.1
• CVE-2026-9834The WP Database Backup – Unlimited Database & Files Backup b…7.2
• CVE-2026-9836IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …7.5
• CVE-2026-9838The ICS Calendar plugin for WordPress is vulnerable to Refle…6.1
• CVE-2026-9842The Backstage - Customizer Demo Access plugin for WordPress …7.5
• CVE-2026-9844Use of default credentials vulnerability in Roche Diagnostic…8.8
• CVE-2026-9848The WP Ticket plugin for WordPress is vulnerable to SQL Inje…7.5
• CVE-2026-9851The Booking Package plugin for WordPress is vulnerable to Pr…7.2
• CVE-2026-9856A vulnerability in huggingface/transformers versions <=5.8.0…7.1
• CVE-2026-9857The Invoice123 plugin for WordPress is vulnerable to authori…4.3
• CVE-2026-9860The Offload, AI & Optimize with Cloudflare Images plugin for…8.8