Skip to content
Threat Feed
Subscribe

Product

Contact Form Extender for Divi Builder (<= 1.0.6)

1 brief RSS
high advisory

Contact Form Extender for Divi Builder: Arbitrary file deletion (CVE-2026-120559)

The Contact Form Extender for Divi Builder plugin for WordPress contains an arbitrary file deletion vulnerability in versions 1.0.6 and below that allows unauthenticated attackers to delete sensitive files via the cfefd_remove_uploaded_file function.

Contact Form Extender for Divi Builder web-vulnerability arbitrary-file-deletion wordpress
1c