The WP Contact Form 7 DB Handler plugin versions up to and including 3.0 allows an adversary to deploy a CSRF attack that triggers a UNION‑based SQL injection, exploits unsanitized numeric input, and deserializes a malicious PHP array. Because the plugin does not verify a security nonce when the _wpnonce field is omitted, an attacker can craft a page that convinces a logged‑in administrator to submit a payload. The faulty deserialization treats array keys containing 'ys_cfdbh_file' as file paths, which are concatenated with the uploads directory and passed to wp_delete_file, enabling deletion of any file on the server, such as wp‑config.php or core system files. This vulnerability is classified as CWE‑352, a Cross‑Site Request Forgery flaw.

Any WordPress site that has the yudiz WP Contact Form 7 DB Handler plugin installed with a version number 3.0 or earlier is affected. The vulnerability impacts all users who manage the plugin on those sites, regardless of their role when the CSRF is triggered.

With a CVSS score of 8.1, the flaw presents a high severity risk. The EPSS score is not listed, so the current exploitation probability is unknown, but the flaw is not yet part of the CISA KEV catalog. The likely attack vector is a CSRF page prepared by an attacker; a logged‑in administrator must be tricked into visiting that page. The attack is trivial to execute from the attacker’s side and requires no additional pre‑conditions beyond the presence of an authenticated administrator. Once executed, the attacker can delete arbitrary files, compromising confidentiality, integrity, and availability of the site.