CVE-2026-9843

Name of the Vulnerable Software and Affected Versions Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions prior to 1.5.2

Description This issue allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation in the view page() function. Exploitation occurs when an administrator views or edits a poisoned form entry; at this point, PHP's bracket parser reshapes an attacker-crafted JSON key to bypass the stored-path isset check, triggering the deletion of a file specified via path traversal. Deleting critical files, such as wp-config.php, can lead to remote code execution. There are reports of increased actor activities targeting this plugin.

Recommendations Update the plugin to a version newer than 1.5.1. As a temporary workaround, restrict administrator access to viewing or editing form entries from untrusted sources until the update is applied.