Contact Form Extender for Divi plugin lets anyone delete server files
A WordPress contact form plugin lets anyone delete server files without logging in.
Summary
A path validation flaw in the Contact Form Extender for Divi WordPress plugin lets unauthenticated attackers delete arbitrary files on the server. All versions up to and including 1.0.6 are affected. Deleting key files such as wp-config.php can lead to remote code execution.
What to do
No source names a fixed version. Check that the installed plugin is newer than 1.0.6 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen