CVE-2026-9843: Arbitrary File Deletion in WordPress Form Plugins (WPforms, Elementor)

Technical summary

The vulnerability stems from insufficient path validation in the view_page function. Attackers bypass the isset check protecting stored file paths by crafting JSON keys that leverage PHP's bracket parser behavior, allowing directory traversal syntax to reach unintended files. When an administrator subsequently accesses or edits the poisoned form entry, the malicious payload executes and deletes the attacker-specified file. The CVSS 3.1 vector (8.1 HIGH) reflects network accessibility, low attack complexity, no authentication requirement from the attacker, and substantial impact on integrity and availability.

Business impact

Successful exploitation can destroy the WordPress configuration file or other critical system files, rendering the site inaccessible and potentially exposing database credentials or sensitive data. Beyond denial of service, deletion of the right files can create conditions for remote code execution, leading to full server compromise, data breach, or malware injection. Recovery typically requires database restoration, file recovery, or complete site rebuild—all costly and disruptive.

Affected systems

All versions of the Database for Contact Form 7, WPforms, and Elementor forms plugins up to and including version 1.5.1 are vulnerable. Any WordPress site using these plugins in an affected version faces risk. The attack surface is broad because these are widely deployed form-building solutions across different WordPress site types.

Exploitability

Exploitation is straightforward for attackers: craft a form entry with a malicious JSON payload designed to traverse file paths, submit it to the form, and wait for an administrator to access the poisoned entry. No special tools, authentication, or advanced techniques are required. The barrier is low because the attacker need only social engineer or directly submit a form entry. However, the attack does require an administrator action (viewing/editing the form entry) to trigger file deletion, which introduces minimal friction given normal admin workflows.

Remediation

Update all affected plugins to a patched version beyond 1.5.1. Verify against the respective vendor advisories for WPforms, Elementor forms, and Database for Contact Form 7 to confirm the exact patched version numbers, as these plugins may have released fixes on different timelines. After patching, review recent form submissions for suspicious entries with unusual JSON structures and audit file modification logs to detect whether exploitation occurred.

Patch guidance

Immediately upgrade the Database for Contact Form 7, WPforms, and Elementor forms plugins to the latest available versions (verify against vendor advisories for exact version numbers). Prioritize this as a critical update due to the HIGH CVSS score and the ease of exploitation. Test patches in a staging environment before production deployment. If plugins are managed via a security or update management tool, confirm the tool is configured to auto-update or flag these plugins for urgent manual review.

Detection guidance

Monitor form submission logs for unusual JSON key structures, particularly those containing path traversal sequences (../, ..\ or similar). Review server file access logs and deletion events around the time form submissions occur, especially in directories containing wp-config.php, .htaccess, or other sensitive configuration files. Implement Web Application Firewall (WAF) rules to block form submissions containing obvious directory traversal payloads. Audit form entry data in the database for suspicious JSON patterns before they are accessed by administrators.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.1), network accessibility, lack of authentication requirement, and potential for catastrophic business impact. Although exploitation requires an administrator action, that action is routine and expected in normal operations, making the practical barrier to success very low. The direct path from arbitrary file deletion to remote code execution amplifies the risk beyond typical availability issues.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects a network-accessible attack (AV:N) with low complexity (AC:L) that requires no authentication from the attacker (PR:N), but does require user interaction—specifically an administrator viewing a poisoned form entry (UI:R). The impact is severe: no confidentiality loss (C:N), but high integrity impact (I:H) from arbitrary file deletion and high availability impact (A:H) from potential system destruction. The score appropriately reflects a critical but not maximum-severity vulnerability.

Frequently asked questions