WordPress Contact Form 7 Database Addon \u2013 CFDB7 Plugin <= 1.2.6.8 is vulnerable to Sensitive Data Exposure<\/p>
Software: Contact Form 7 Database Addon \u2013 CFDB7<\/p>
Link: https:\/\/wordpress.org\/plugins\/contact-form-cfdb7\/#developers<\/p>
Affected Version <= 1.2.6.8<\/p>
Fixed in version 1.2.7 <\/p>","date":"2024-04-29"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"5.3","severity":"m","exploitable":"3.9","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"1.4"},"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"9c1da597c438676d71fac2e9091385bc26e0a9a0936f160cc4ed2806f0d765b2","name":"Database Addon for Contact Form 7 – CFDB7 [contact-form-cfdb7] < 1.3.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.3.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-6740","name":"Contact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-6740","description":"The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018tmpD\u2019 parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"0000-00-00"},{"id":"908a550732e0facd96f569a0b0790de20549db04","name":"Contact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/contact-form-cfdb7\/contact-form-7-database-addon-131-unauthenticated-stored-cross-site-scripting-via-tmpd-parameter","description":"The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018tmpD\u2019 parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-07-03"},{"id":"b67a0e519f2c793f88c9184c542fbfcb9ed5427c","name":"WordPress Contact Form 7 Database Addon \u2013 CFDB7 Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/contact-form-cfdb7\/vulnerability\/wordpress-contact-form-7-database-addon-plugin-1-3-1-unauthenticated-stored-cross-site-scripting-via-tmpd-parameter-vulnerability","description":"
WordPress Contact Form 7 Database Addon \u2013 CFDB7 Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: Contact Form 7 Database Addon \u2013 CFDB7<\/p>
Fixed in version 1.3.2 <\/p>
Affected Version <= 1.3.1<\/p>
CVE: CVE-2025-6740<\/p>","date":"2025-07-07"},{"id":"EUVD-2025-19965","name":"EUVD-2025-19965","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-19965","description":"The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018tmpD\u2019 parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-07-04"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"epss":"0.002"}},{"uuid":"df954eccfa61263e709941f8c71ae27e88d332c66a70f8c1cb2b2c06b525bbb6","name":"Database Addon for Contact Form 7 – CFDB7 [contact-form-cfdb7] <= 1.3.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.3.2","max_operator":"le","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-4665","name":"","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-4665","description":"WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.","date":"0000-00-00"},{"id":"EUVD-2025-36574","name":"EUVD-2025-36574","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-36574","description":"WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.","date":"2025-10-28"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"h","i":"h","a":"h","score":"9.6","severity":"c","exploitable":"2.8","impact":"6.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H","score":"9.6","severity":"critical","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"high","i":"high","a":"high","exploitable":"2.8","impact":"6.0"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"cb43e5c7758e5ec6d52f129b8557efbf3368d9de0ef0d0dfdf96a22b31dc8b1e","name":"Database Addon for Contact Form 7 – CFDB7 [contact-form-cfdb7] < 1.4.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.4.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-107652","name":"CVE-2026-107652","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-107652","description":"[en] The Database Addon for Contact Form 7 \u2013 CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()\/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.","date":"2026-10-14"},{"id":"2d417ca843d0562235a09fcefe3a87273c0711ce","name":"Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/contact-form-cfdb7\/database-addon-for-contact-form-7-141-unauthenticated-limited-file-deletion-via-injected-attackcfdb7-file-submission-field","description":"The Database Addon for Contact Form 7 \u2013 CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()\/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.","date":"2025-07-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"5.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-639","name":"Authorization Bypass Through User-Controlled Key","description":"The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1791956906"}