CVE-2026-9145

Name of the Vulnerable Software and Affected Versions Database for Contact Form 7, WPforms, Elementor forms versions prior to 1.5.2

Description An arbitrary file copy issue exists in the create entry el() function. The function retrieves the raw value from the Elementor Pro Form Record object for upload-type fields and passes it to the PHP copy() function without verifying if the value is a legitimate uploaded file. When no file is present in the $ FILES array, raw value reflects a POST string controlled by the attacker. Since copy() supports both local filesystem paths and remote URLs, an unauthenticated attacker can target any file readable by the PHP process or provide a remote URL to disclose arbitrary files from the server. Elementor Pro is required to trigger the code path, but the flaw resides in the Contact Form Entries handler. While the file is copied to a hashed directory, the directory name is generated using uniqid() and rand(), which are non-cryptographic and do not provide reliable protection.

Recommendations Update to a version newer than 1.5.1. As a temporary workaround, restrict the use of the create entry el() function until the update is applied.