CVE-2026-107652: CWE-639 Authorization Bypass Through User-Controlled Key in arshidkv12 Database Addon for Contact Form 7 – CFDB7

CVE-2026-107652 describes an authorization bypass vulnerability in the Database Addon for Contact Form 7 – CFDB7 plugin for WordPress, affecting versions up to 1.4.1. The vulnerability arises from the plugin's process_bulk_action() delete handler, which deletes files by matching any stored key containing the substring 'cfdb7_file' and passing the associated value directly to the unlink() function without validating that the file belongs to the submission being deleted or sanitizing the filename with basename() or realpath(). This allows unauthenticated attackers to inject crafted multipart fields that can trigger arbitrary file deletion on the server.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin. This can lead to denial of service or disruption of website functionality. The vulnerability does not impact confidentiality or availability directly but allows integrity impact through unauthorized file deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the plugin's bulk action features and monitor for suspicious activity. Avoid using this plugin version in untrusted environments.