Threats tagged 'ghsa-93rj-fp96-fpfj'

The Contact Form Extender for Divi Builder WordPress plugin up to version 1.0.6 has an arbitrary file deletion vulnerability due to insufficient file path validation in the cfefd_remove_uploaded_file() function. This flaw allows unauthenticated attackers to delete arbitrary files on the server by exploiting a nonce exposed publicly via wp_localize_script. Deleting critical files like wp-config.php could lead to remote code execution.