CVE-2026-9843 describes a CWE-22 path traversal vulnerability in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin affecting all versions up to and including 1.5.1. The flaw is due to insufficient validation of file paths in the view_page function, enabling unauthenticated attackers to delete arbitrary files on the server. Exploitation requires an administrator to interact with a poisoned form entry, where PHP's bracket parser manipulates the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of files specified via path traversal. This arbitrary file deletion can lead to remote code execution if critical files such as wp-config.php are removed. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, low attack complexity, no privileges required, but user interaction needed, and high impact on integrity and availability. No vendor advisory or patch information is provided, and no known exploits in the wild are reported.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the server by leveraging an administrator's interaction with a malicious form entry. This can cause denial of service and potentially enable remote code execution if critical files like wp-config.php are deleted. The integrity and availability of the affected system are severely impacted. Confidentiality impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and avoid viewing or editing suspicious form entries. Monitor for updates from the crmperks vendor regarding patches or official mitigations.