Contact Form Extender for Divi Builder (<= 1.0.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/contact-form-extender-for-divi-builder--1.0.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 05:54:50 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgContact Form Extender for Divi Builder: Arbitrary file deletion (CVE-2026-120559)https://feed.craftedsignal.io/briefs/2026-11-contact-form-extender-arbitrary-file-deletion/Tue, 03 Nov 2026 05:54:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-contact-form-extender-arbitrary-file-deletion/The Contact Form Extender for Divi Builder plugin for WordPress contains an arbitrary file deletion vulnerability in versions 1.0.6 and below that allows unauthenticated attackers to delete sensitive files via the cfefd_remove_uploaded_file function.The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient path validation in the cfefd_remove_uploaded_file() function. The vulnerability affects all versions up to and including 1.0.6. An unauthenticated attacker can retrieve the nonce required for this AJAX action from the public page source, allowing them to delete arbitrary files on the server. Successful exploitation could lead to remote code execution by deleting critical configuration files like wp-config.php.

Impact

Successful exploitation allows unauthenticated attackers to delete arbitrary files from the web server, potentially resulting in complete site compromise or remote code execution.

Recommendation

  1. Identify all WordPress installations running the "Contact Form Extender for Divi Builder" plugin.
  2. Disable or remove the plugin until a patch is released by the developer.
  3. Monitor web server access logs for anomalous POST requests targeting the AJAX endpoint associated with the cfefd_remove_uploaded_file function.
]]>highadvisoryweb-vulnerabilityarbitrary-file-deletionwordpress