Path traversal in Contact Form Extender for Divi allows file deletion
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
The Contact Form Extender for Divi (Submissions DB & Extra Fields) plugin for WordPress is affected in all versions from 0 through 1.0.6. Insufficient file path validation in the cfefd_remove_uploaded_file() function is a path traversal flaw (CWE-22). An unauthenticated attacker can delete arbitrary files on the server because the required nonce is exposed in the public page source, and deleting a file such as wp-config.php can lead to remote code execution.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wp_localize_script and is therefore retrievable by any unauthenticated visitor.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Satinder Singh | Contact Form Extender for Divi – Submissions DB & Extra Fields | up to 1.0.6 | — | No fix listed | CNA |
- Contact Form Extender for Divi – Submissions DB & Extra Fields VendorSatinder Singh Affected up to 1.0.6 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Contact Form Extender for Divi (Submissions DB & Extra Fields).
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Timeline
- 2026-11-03 Threatist record created from CVE-2026-120559
- 2026-11-03 Alias added: GHSA-93rj-fp96-fpfj
- 2026-11-04 Priority changed: MEDIUM → LOW
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7bbead7c-47b9-473f-b335-6fae4b5998d6?source=cve
- https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.3/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L159
- https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.3/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L18
- https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.7/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L166
- https://plugins.trac.wordpress.org/changeset?old_path=contact-form-extender-for-divi-builder%2Ftags%2F1.0.6&new_path=contact-form-extender-for-divi-builder%2Ftags%2F1.0.7
- https://wordpress.org/plugins/contact-form-extender-for-divi-builder/#developers
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3499767%40contact-form-extender-for-divi-builder%2Ftrunk&old=3499766%40contact-form-extender-for-divi-builder%2Ftrunk&sfp_email=&sfph_mail=
More Satinder Singh vulnerabilities
- TI-2026-29438 Path traversal in Satinder Singh Contact Form Extender for Divi – Save Entries… CVSS 3.1HIGH 8.6
Sources
- CVE-2026-120559 · CVE Program
- CVE-2026-120559 · NVD
- FIRST EPSS
- GHSA-93rj-fp96-fpfj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences