Satinder Singh vulnerabilities and threats

The Contact Form Extender for Divi Builder WordPress plugin (up to version 1.0.6) contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. This is due to insufficient validation of file paths in the cfefd_remove_uploaded_file() function. The vulnerability is exploitable because the nonce protecting the AJAX action is exposed publicly via wp_localize_script, enabling attackers to retrieve it without authentication. Deleting critical files such as wp-config.php can lead to remote code execution.

CVE-2026-40769 is a high severity vulnerability in the Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field plugin, affecting versions up to and including 1.0.6. It allows unauthenticated attackers to perform arbitrary file deletion via a path traversal flaw. This vulnerability does not impact confidentiality or integrity but causes a high impact on availability by enabling deletion of files. No official patch or remediation guidance is currently provided by the vendor.