CVE-2026-9145: Arbitrary File Copy in Contact Form 7 & Database for Contact Form 7 WordPress Plugin

Technical summary

The vulnerability exists in the create_entry_el() function within Contact Form Entries' handler for Elementor Pro forms. When processing form submissions on the elementor_pro/forms/new_record hook, the function reads the raw_value attribute from Elementor Pro's Form_Record object for upload-type fields. For fields where no actual file upload occurred (i.e., nothing in $_FILES), raw_value contains unvalidated POST data controlled by the attacker. This value is passed directly to PHP's copy() function without verification that it represents a legitimately uploaded file. Since copy() interprets both local filesystem paths and remote URLs, an attacker can craft malicious POST requests to exfiltrate any file readable by the web server process. While the destination directory name incorporates uniqid() and rand() values, these are non-cryptographic and insufficient as a primary defense. The vulnerability is entirely within Contact Form Entries; Elementor Pro's role is limited to owning the hook and populating the Form_Record object.

Business impact

This vulnerability enables unauthorized information disclosure on WordPress sites using Contact Form 7 with Elementor Pro. Attackers can access sensitive files such as wp-config.php (containing database credentials), .env files, private keys, customer data stored in uploads, or configuration files. The combination of unauthenticated access and high-confidence file retrieval creates significant risk for credential compromise and downstream lateral movement. Sites relying on file obscurity rather than access controls are particularly exposed. The medium CVSS score reflects meaningful exploitability but acknowledges that the attacker must know or guess target file paths and handle the copied file output appropriately.

Affected systems

The Database for Contact Form 7 WordPress plugin is vulnerable in versions up to and including 1.5.1. Exploitation requires Elementor Pro to be installed and active; the vulnerable hook is owned by Elementor Pro and will not be triggered without it. Any WordPress installation running an affected version of Contact Form Entries with Elementor Pro enabled is at risk, regardless of authentication configuration. Third-party forms using the elementor_pro/forms/new_record hook may also be indirectly affected if they interact with Contact Form Entries.

Exploitability

Exploitation is moderately straightforward for an attacker with basic knowledge of target server architecture. No authentication is required. The attacker must craft a POST request to a page containing an Elementor form connected to Contact Form Entries, specifying an upload-type field with a raw_value parameter pointing to a target file (e.g., /etc/passwd or a web-accessible path to wp-config.php). The medium CVSS assessment reflects the need to guess file paths and coordinate retrieval, as the copied file lands in an unpredictable directory. However, common WordPress file locations and known plugin/theme paths significantly reduce attack difficulty in practice. No patches exist in public advisories, making all affected versions equally vulnerable.

Remediation

Disable Contact Form Entries or Elementor Pro if they are not actively needed. If either tool is required, update the Contact Form Entries plugin immediately when a patched version becomes available—verify the version number against the vendor's official advisory. As a defense-in-depth measure, restrict file system permissions so the PHP process cannot read sensitive configuration files outside the web root, and store wp-config.php and .env files outside the document root. Additionally, implement Web Application Firewall rules to detect unusual patterns in form submissions (e.g., file paths in POST parameters) and monitor for unexpected copy() function activity in web server logs.

Patch guidance

No patched version has been identified in current advisories. Monitor the official Contact Form 7 and Database for Contact Form 7 plugin repositories for updates. When a patch is released, it will likely add input validation to ensure raw_value corresponds to a file actually present in $_FILES before passing it to copy(). Apply patches at your earliest convenience after confirming compatibility with your Elementor and WordPress versions. Test thoroughly in a staging environment before deploying to production.

Detection guidance

Monitor web server and PHP error logs for copy() function calls involving unexpected file paths or URLs in POST parameters. Check access logs for form submissions containing file path strings (e.g., /etc/passwd, ../../../, wp-config.php) in POST data. Implement file integrity monitoring on sensitive files (wp-config.php, .env) to detect unauthorized copies. Search database query logs for unusual database access patterns that might indicate credential misuse after exfiltration. Use WordPress security plugins to flag upload-type form fields and audit their handlers. Consider deploying a WAF rule to block POST requests containing common file path patterns or URL schemes in form parameters.

Why prioritize this

Although marked MEDIUM severity, this vulnerability warrants prompt attention because it requires no authentication, affects a commonly used form plugin ecosystem, and directly enables sensitive data disclosure. The combination of Contact Form 7's prevalence and Elementor Pro's popularity means a significant portion of WordPress sites could be vulnerable. Data exfiltration can lead to credential compromise and lateral movement, elevating real-world impact beyond the CVSS score. Sites handling customer personal data or running e-commerce operations should prioritize patching. The absence of reliable path obfuscation means attackers benefit immediately from any new exploit proof-of-concept shared in the community.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible vulnerability requiring no user interaction or privileges (AV:N, PR:N, UI:N) but with high attack complexity (AC:H) due to the need to guess correct file paths and output destination. The impact vector emphasizes high confidentiality impact (disclosure of arbitrary files) with limited integrity risk (local file writes to an unpredictable location). The score does not account for the prevalence of Contact Form 7 or the prevalence of credential material stored in typical WordPress configurations; practitioners should apply organizational context to determine their personal risk tolerance.

Frequently asked questions