{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/contact-form-extender-for-divi-builder--1.0.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:contact_form_extender_for_divi_builder_project:contact_form_extender_for_divi_builder:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-120559"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Contact Form Extender for Divi Builder (\u003c= 1.0.6)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","arbitrary-file-deletion","wordpress"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient path validation in the cfefd_remove_uploaded_file() function. The vulnerability affects all versions up to and including 1.0.6. An unauthenticated attacker can retrieve the nonce required for this AJAX action from the public page source, allowing them to delete arbitrary files on the server. Successful exploitation could lead to remote code execution by deleting critical configuration files like wp-config.php.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to delete arbitrary files from the web server, potentially resulting in complete site compromise or remote code execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eIdentify all WordPress installations running the \u0026quot;Contact Form Extender for Divi Builder\u0026quot; plugin.\u003c/li\u003e\n\u003cli\u003eDisable or remove the plugin until a patch is released by the developer.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests targeting the AJAX endpoint associated with the cfefd_remove_uploaded_file function.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-03T05:54:50Z","date_published":"2026-11-03T05:54:50Z","id":"https://feed.craftedsignal.io/briefs/2026-11-contact-form-extender-arbitrary-file-deletion/","summary":"The Contact Form Extender for Divi Builder plugin for WordPress contains an arbitrary file deletion vulnerability in versions 1.0.6 and below that allows unauthenticated attackers to delete sensitive files via the cfefd_remove_uploaded_file function.","title":"Contact Form Extender for Divi Builder: Arbitrary file deletion (CVE-2026-120559)","url":"https://feed.craftedsignal.io/briefs/2026-11-contact-form-extender-arbitrary-file-deletion/"}],"language":"en","title":"CraftedSignal Threat Feed - Contact Form Extender for Divi Builder (\u003c= 1.0.6)","version":"https://jsonfeed.org/version/1.1"}