The vulnerability allows an unauthenticated user to delete any file on the web server by exploiting insufficient path validation in the cfefd_remove_uploaded_file() function. Deleting critical files such as wp-config.php can enable attackers to compromise the entire WordPress installation, resulting in full remote code execution. This weakness is a classic path traversal flaw, classified as CWE-22.

The affected product is the WordPress plugin Contact Form Extender for Divi – Submissions DB & Extra Fields, versions up to and including 1.0.6. Any site running these versions carries the risk, regardless of user role, because the AJAX action is protected by a nonce that is exposed on publicly accessible pages.

The CVSS score of 7.5 indicates a high severity flaw. Because the EPSS score is not reported, the current exploitation probability cannot be quantified, but the fact that the vulnerability is fully exploitable without authentication and can lead to remote code execution makes it a high‑risk target for attackers. It is not listed in the CISA KEV catalog; however, the negative server consequences and public exposure of the nonce create a likely attack vector for widespread use.