CVE-2026-6455 affects the yudiz WP Contact Form 7 DB Handler WordPress plugin through a missing nonce verification in the process_bulk_action() function. The nonce check is bypassed by omitting the _wpnonce POST field, enabling a CSRF attack. This is combined with an unparameterized SQL query vulnerable to UNION-based SQL injection, allowing an attacker to inject a malicious serialized PHP array into the post_content field. Unsafe deserialization of this data leads to PHP object injection, where file paths derived from the injected data are passed to wp_delete_file() without path traversal validation. This chain of vulnerabilities allows an attacker to delete arbitrary files on the server, including critical WordPress and system files. The vulnerability is rated high severity with a CVSS score of 8.1 and requires user interaction but no privileges.

Successful exploitation allows an attacker to delete arbitrary files on the affected server, including critical configuration files such as wp-config.php and potentially system files. This compromises the integrity and availability of the WordPress installation and the underlying system. The attack requires a logged-in administrator to be tricked into triggering the malicious request, but no prior privileges or authentication bypass is needed beyond that. There is no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted pages while logged into WordPress with administrative privileges. Monitoring for plugin updates from yudiz is recommended to apply any forthcoming official fixes. No vendor advisory or patch links are currently provided.