CVE-2021-24905: Advanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File Deletion

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-21 · updated 2026-06-17
Weakness: CWE-863

Description

The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.

Affected products

Vsourz Digital Advanced Contact form 7 DB (WordPress plugin): before 1.8.7 — fixed in 1.8.7

How to fix

Upgrade to a fixed version: Vsourz Digital Advanced Contact form 7 DB (WordPress plugin) 1.8.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24905 or the next vulnerability affects your stack