Unrated

Unauthenticated Arbitrary File Deletion in Database for Contact Form 7, WPforms, Elementor forms

IdentifiersCVE-2026-9843CWE-22

CVE-2026-9843 affects the WordPress plugin Database for Contact Form 7, WPforms, Elementor forms in all versions up to and including 1.5.1. The vulnerability is caused by insufficient file path validation in the plugin's view_page function. An attacker can submit a poisoned form entry containing an attacker-crafted JSON key that, when later processed, is reshaped by PHP's bracket parser in a way that bypasses the plugin's stored-path isset check. This allows deletion of a traversal-specified file on the server. The issue is exploitable without authentication, but exploitation is only triggered when an administrator views or edits the malicious form entry.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated attacker to delete arbitrary files accessible to the web server on the underlying host. This can cause application instability or denial of service and may also enable follow-on compromise. In particular, deletion of security-critical WordPress files such as wp-config.php can create conditions that lead to remote code execution or full site compromise, depending on server configuration and subsequent attacker actions. The vulnerability therefore has high integrity, availability, and confidentiality implications.

Mitigation

If you can’t patch tonight, do this now.

If an immediate patch is not available, reduce exposure by disabling the affected plugin or restricting access to forms that feed into it. Review and remove suspicious form entries that may contain attacker-crafted payloads before administrators open them. Limit filesystem permissions for the web server user to the minimum necessary so arbitrary deletion has reduced impact, and monitor for unexpected file deletions or changes to critical WordPress files. Administrative users should avoid viewing or editing untrusted submissions until remediation is complete.

Remediation

Patch, then assume compromise.

Update Database for Contact Form 7, WPforms, Elementor forms to a version newer than 1.5.1 that addresses the file path validation flaw in view_page. In addition, review the plugin's handling of uploaded-file metadata and stored form entries, inspect for malicious or poisoned submissions, and verify that no unauthorized file deletions have already occurred. Restore any deleted files from trusted backups as needed.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

cvefeed high severityNews

Jun 20, 2026

CVE-2026-9843 - Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value

An unauthenticated arbitrary file deletion vulnerability in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin affecting versions up to and including 1.5.1. It is caused by insufficient file path validation in the view_page function and can lead to remote code execution if critical files are deleted.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-9843

NVD

nvd.nist.gov/vuln/detail/CVE-2026-9843

MITRE CWE · CWE-22

cwe.mitre.org