{"id":"CVE-2026-120559","kind":"vulnerability","aliases":["CVE-2026-120559"],"related":[],"title":"Contact Form Extender for Divi Builder <= 1.0.6: unauthenticated arbitrary file deletion via path traversal","description":"The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wp_localize_script and is therefore retrievable by any unauthenticated visitor.","summary":"The Contact Form Extender for Divi Builder WordPress plugin, version 1.0.6 and earlier, fails to validate file paths in its file removal function. An unauthenticated visitor can delete arbitrary files on the server, such as wp-config.php, which can lead to remote code execution.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"contact-form-extender-for-divi-builder","fixed":["1.1.5"],"affected":"<= 1.0.6","ecosystem":"wordpress"}],"ecosystems":[],"tags":["contact-form-extender","divi","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-above-1.0.6"],"how_to_check":"- WordPress admin > Plugins: find 'Contact Form Extender for Divi' (slug contact-form-extender-for-divi-builder) and check the version; 1.0.6 or lower is affected.\n- Or read the Version: line in wp-content/plugins/contact-form-extender-for-divi-builder/ main plugin file.\n- Also check that wp-config.php and other key files are still present; deletion of wp-config.php can force the site into reinstall.","fix":"Update the plugin to the latest release (1.1.5 on wordpress.org). 1.0.7 added the file-deletion validation fix for the sibling CVE-2026-40769; Wordfence marks this CVE Patched but does not name the exact version, so do not stay on 1.0.7 if you can move to 1.1.5.","status":"open","published_at":"2026-11-03T05:18:33+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","triaged_at":"2026-11-03T05:49:50+00:00","updated_at":"2026-11-03T05:51:08+00:00","category":"package","confidence":0.65,"triage":{"at":"2026-11-03T05:49:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Contact Form Extender for Divi: unauthenticated file deletion enables server takeover","impact":"high","summary":"The Contact Form Extender for Divi Builder WordPress plugin, version 1.0.6 and earlier, fails to validate file paths in its file removal function. An unauthenticated visitor can delete arbitrary files on the server, such as wp-config.php, which can lead to remote code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","divi","contact-form-extender","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attackers delete wp-config.php, enabling remote code execution on the server.","analyst_note":"Sources do not state a fixed version; check the plugin's changelog or the WordPress.org plugin page for a patched release after 1.0.6.","how_to_check":"- Check whether the plugin is installed and its version in the WordPress admin under Plugins, or look for the plugin folder named like `contact-form-extender-for-divi` in `wp-content/plugins/`\n- Read the plugin's main file header for the `Version:` line and compare it with `1.0.6`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running WordPress with the Contact Form Extender for Divi Builder plugin at version 1.0.6 or earlier are exposed, because the flawed file removal action is reachable by any visitor who can read the nonce from the public page source. Sites without this plugin installed are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4229,"output_tokens":605,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not state a fixed version; check the plugin's changelog or the WordPress.org plugin page for a patched release after 1.0.6.","search":"'-120559':17A,20A '-2026':16A,19A '1.0.6':7A,51B,120C 'action':157C 'ajax':156C 'arbitrari':9A,69B,97C,130C 'attack':127C 'builder':6A,27A,47B,90C 'cfefd':108C 'code':82B,141C 'contact':1A,22A,29B,42B,85C 'contact-form-extend':28B 'contact-form-extender-for-divi-builder':21A 'cve':15A,18A 'delet':11A,68B,99C,129C,148C 'divi':5A,26A,32B,46B,89C 'due':100C 'earlier':53B 'easili':137C 'execut':83B,142C 'extend':3A,31B,44B,87C 'extender':24A 'fail':54B 'file':10A,57B,61B,70B,98C,103C,111C,131C,146C 'for':25A 'form':2A,23A,30B,43B,86C 'function':63B,112C 'host':36B 'includ':119C 'insuffici':102C 'lead':79B,138C 'local':167C 'make':122C 'nonc':153C 'packag':33B 'page':163C 'path':13A,58B,104C 'plugin':40B,49B,91C 'possibl':124C 'protect':154C 'public':162C 'remot':81B,140C 'remov':62B,109C 'render':159C 'retriev':172C 'right':145C 'script':168C 'self':35B 'self-host':34B 'server':73B,134C 'sourc':164C 'therefor':171C 'travers':14A 'unauthent':8A,65B,126C,175C 'upload':110C 'valid':56B,105C 'version':50B,115C 'via':12A,165C 'visitor':66B,176C 'vulner':95C 'wordpress':37B,39B,48B,93C 'wordpress-plugin':38B 'wp':166C 'wp-config.php':76B,151C","nicknames":[],"mitigations":[],"who_affected":"Sites running WordPress with the Contact Form Extender for Divi Builder plugin at version 1.0.6 or earlier are exposed, because the flawed file removal action is reachable by any visitor who can read the nonce from the public page source. Sites without this plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["contactformextenderfordivibuilder"],"ptokens":["builder","contact","divi","extender","for","form"],"labels":["contactformextender","divi","high","package","selfhosted","wordpress","wordpressplugin"],"first_public_at":"2026-11-03T05:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120559","severity":null,"published_at":"2026-11-03T05:18:33+00:00","modified_at":"2026-11-03T05:18:33+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","fetched_at":"2026-11-03T05:48:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120559:1456","url":null,"severity":null,"published_at":"2026-11-03T05:51:08+00:00","modified_at":"2026-11-03T05:51:08+00:00","first_seen_at":"2026-11-03T05:51:08+00:00","fetched_at":"2026-11-03T05:51:08+00:00","note":"Wordfence lists CVE-2026-120559 (path traversal in cfefd_remove_uploaded_file, researcher crattack, Aug 4 2026) as Patched but gives no fixed version. wordpress.org changelog: 1.0.7 (Apr 6 2026) security fix for unauthorized file deletion (matches sibling CVE-2026-40769), latest 1.1.5; 1.1.1 'improved security' unspecified. Not stated which release closes this exact CVE, so nothing marked verified; advise latest. No exploitation or PoC found."}],"documents":[{"id":55855,"url":"https://wordpress.org/plugins/contact-form-extender-for-divi-builder/","title":"Contact Form Extender for Divi – plugin page and changelog (wordpress.org)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":55856,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-extender-for-divi-builder","title":"Wordfence: Contact Form Extender for Divi vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}