Contact Form Extender for Divi Builder: Arbitrary file deletion (CVE-2026-120559)

The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient path validation in the cfefd_remove_uploaded_file() function. The vulnerability affects all versions up to and including 1.0.6. An unauthenticated attacker can retrieve the nonce required for this AJAX action from the public page source, allowing them to delete arbitrary files on the server. Successful exploitation could lead to remote code execution by deleting critical configuration files like wp-config.php.

Impact

Successful exploitation allows unauthenticated attackers to delete arbitrary files from the web server, potentially resulting in complete site compromise or remote code execution.

Recommendation

1. Identify all WordPress installations running the "Contact Form Extender for Divi Builder" plugin.
2. Disable or remove the plugin until a patch is released by the developer.
3. Monitor web server access logs for anomalous POST requests targeting the AJAX endpoint associated with the cfefd_remove_uploaded_file function.