Skip to content
Threat Feed

Product

WP Contact Form 7 DB Handler Plugin (<= 3.0)

1 brief RSS
high threat

WP Contact Form 7 DB Handler Plugin CSRF leading to Arbitrary File Deletion (CVE-2026-6455)

The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF), leading to arbitrary file deletion via SQL injection and PHP object injection due to missing nonce verification and unsafe deserialization, allowing attackers to delete arbitrary files on the server.

WP Contact Form 7 DB Handler plugin cve csrf sqli php object injection wordpress
2r 3t 1c