CVE-2026-9843 is a path traversal vulnerability (CWE-22) in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin, affecting all versions up to 1.5.1. The vulnerability arises from insufficient validation of file paths in the view_page function, allowing unauthenticated attackers to delete arbitrary files on the server. Exploitation requires an administrator to interact with a maliciously crafted form entry, where PHP's bracket parser manipulates the JSON key to bypass the stored-path check and trigger deletion of files specified via path traversal sequences. This can lead to remote code execution if critical files such as wp-config.php are deleted.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the server, which can cause denial of service and potentially enable remote code execution by removing critical files like wp-config.php. The vulnerability requires an administrator to view or edit the malicious form entry, thus involving user interaction with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to the affected plugin's form entries and monitor for suspicious activity. Avoid viewing or editing untrusted form entries. Follow vendor updates closely for an official fix.