CVE WATCH / VULNERABILITY DETAIL
CVE-2026-120559
HIGHCVSS 7.5NVD feed
Published 3 November 2026 · tracked since 3 November 2026
Description
The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete a
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-121443 MEDIUM 5.3
- CVE-2026-121444 HIGH 7.5
- CVE-2026-121435 MEDIUM 4.3
- CVE-2026-121436 HIGH 7.2
- CVE-2026-121417 HIGH 7.8
- CVE-2026-121392 HIGH 7.4
- CVE-2026-118527 MEDIUM 4.3
- CVE-2026-106991 HIGH 7.1
- CVE-2026-119742 HIGH 7.2
- CVE-2026-119179 HIGH 7