CVE-2026-120559 in Contact Form Extender for Divi Plugin
Summary
by MITRE • 11/03/2026
The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wp_localize_script and is therefore retrievable by any unauthenticated visitor.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The Contact Form Extender for Divi Builder plugin, specifically in versions up to 1.0.6, contains a critical security vulnerability classified as Arbitrary File Deletion. This flaw stems from insufficient validation of file paths within the cfefd_remove_uploaded_file function, which is exposed via an AJAX endpoint. The core technical issue lies in the lack of rigorous sanitization and verification mechanisms when processing user-supplied input for file deletion operations. An attacker can manipulate this parameter to traverse directory structures or target specific system files by providing maliciously crafted path strings that bypass intended restrictions. This type of vulnerability aligns with CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, although in this context it escalates beyond simple access control issues into destructive file manipulation capabilities due to the deletion nature of the operation rather than just reading sensitive data.
The operational impact of this vulnerability is severe because it allows unauthenticated attackers to delete arbitrary files on the web server without any prior authentication or privilege escalation. The attack vector relies heavily on a flawed implementation of security controls regarding nonces, which are tokens used to prevent Cross-Site Request Forgery attacks. In this specific case, the nonce required for the AJAX action is rendered into the public page source through the wp_localize_script function. This design decision inadvertently exposes the token to any visitor viewing the page source code, effectively neutralizing its protective value against unauthenticated requests. Consequently, an attacker can easily retrieve a valid nonce and combine it with malicious file path inputs to execute deletion commands on the server infrastructure.
The consequences of successful exploitation extend beyond mere data loss or service disruption; they frequently lead to Remote Code Execution (RCE). By deleting critical configuration files such as wp-config.php, which contains database credentials and security keys, an attacker can destabilize the WordPress installation's integrity and potentially exploit subsequent vulnerabilities that arise from missing configurations. Furthermore, if other sensitive system files are targeted, it may allow for further exploitation vectors or complete compromise of the underlying operating system depending on server permissions and configuration. This scenario is consistent with ATT&CK technique T1485, Data Destruction, where adversaries aim to disrupt availability by destroying data rather than encrypting it for ransomware purposes.
Mitigation strategies must address both the immediate vulnerability and broader security hygiene practices. The most effective remediation is upgrading the plugin to a version that patches this flaw, ensuring that file path validation includes strict allow-lists or canonicalization checks to prevent directory traversal and unauthorized deletions. Developers should also review how nonces are handled in AJAX endpoints; they must never be exposed via client-side scripts like wp_localize_script if those endpoints require authentication tokens for security. Implementing server-level protections, such as restricting file write permissions and using Web Application Firewalls that detect common exploitation patterns for arbitrary deletion attacks, provides an additional layer of defense. Regular audits of plugin code against industry standards like CWE-20 for Improper Input Validation are essential to prevent similar flaws in future updates or other plugins within the WordPress ecosystem.