CVE-2026-6455

Vulnerability

The WP Contact Form 7 DB Handler plugin for WordPress versions up to and including 3.0 is vulnerable to a Cross-Site Request Forgery (CSRF) that leads to arbitrary file deletion via SQL injection and PHP object injection. The vulnerability resides in the process_bulk_action() function in form-inner-page-class.php [1]. The nonce check is only performed when the _wpnonce parameter is present in the POST body; if omitted, the check is bypassed. Additionally, a user-supplied value is used unsanitized in a numeric SQL context (WHERE ID = $ID), and the post_content field from the query result is deserialized without validation.

Exploitation

An attacker can craft a malicious page that, when visited by a logged-in administrator, triggers a CSRF request to the vulnerable endpoint. The attacker omits the _wpnonce field to bypass the nonce check. The request includes a UNION-based SQL injection payload using CHAR() to avoid quote-escaping by esc_sql(). This payload returns a row with a crafted serialized PHP array in the post_content column. Upon deserialization, the plugin iterates over array keys containing 'ys_cfdbh_file' and uses the corresponding values as file paths, appending them to the WordPress uploads directory without validating for path traversal. The resulting path is then passed to wp_delete_file(), deleting the targeted file.

Impact

A successful attack allows an unauthenticated attacker (via CSRF) to delete arbitrary files on the server, including sensitive files such as wp-config.php or system files, leading to complete site compromise and potential server takeover. The attacker gains the ability to delete any file writable by the web server user, with no privilege escalation beyond the administrator's session used in the CSRF.

Mitigation

As of the publication date (2026-05-28), no fixed version has been released. The vendor has not yet addressed the vulnerability. Users should disable the plugin until a patch is available. There is no known workaround. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time.