The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress allows an attacker to delete arbitrary files on the server. By submitting a form that includes a field whose name contains the substring 'cfdb7_file', the plugin stores the value in its database and later passes it directly to unlink() during a bulk delete operation. The lack of path validation means the attacker can specify any file writable by the web server, enabling deletion of core files, configuration data, or logs and disrupting the site. This vulnerability represents a CWE‑639 authorization bypass that permits an unauthenticated user to influence privileged file deletion.

The flaw affects the CFDB7 plugin, released by vendor arshidkv12, in all versions up to and including 1.4.1. Any WordPress installation that has this plugin and uses the bulk delete feature is susceptible. The issue is not tied to a particular theme or other plugins, so the scope extends to any site running these plugin versions.

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score of less than 1% shows low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can submit a specially crafted form containing a field whose name includes 'cfdb7_file', leading the plugin to store this value. When the bulk delete action is later invoked (by any user who triggers the bulk delete functionality), the stored value is passed to unlink() without validation, resulting in deletion of the specified file. Thus the attacker can delete any file that is writable by the web server, potentially compromising the site's integrity and availability.