WordPress Contact Form 7 CSRF Bypass Enables Arbitrary File Deletion

The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via SQL Injection and PHP Object Injection in versions up to and including 3.0. This is due to a missing nonce verification in the process_bulk_action() function, the nonce check is only executed when _wpnonce is present in the POST body, allowing it to be trivially bypassed by omitting the field, combined with the use of an unsanitized, unparameterized user-supplied value in a numeric SQL context (WHERE ID = $ID) and the unsafe deserialization of the query result's post_content field. An attacker can craft a CSRF page that tricks a logged-in administrator into triggering a UNION-based SQL injection payload (using CHAR() to avoid esc_sql quote-escaping) that returns a malicious serialized PHP array as post_content; upon deserialization, array values associated with keys containing 'ys_cfdbh_file' are used as file paths appended to the uploads directory pa

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Contact Form 7 DB Handler plugin contains a critical CSRF vulnerability that allows attackers to bypass nonce verification by simply omitting the _wpnonce field from POST requests. This flaw, present in versions up to 3.0, enables arbitrary file deletion through SQL injection and PHP object injection in the process_bulk_action() function. WordPress sites running this plugin are at immediate risk, as attackers can craft malicious requests that delete critical database records or files without user consent. The vulnerability affects any WordPress administrator or site using this popular form-handling plugin, potentially leading to data loss, site defacement, or complete compromise.

Casky's 301 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns behind this vulnerability across two critical MITRE ATT&CK techniques: TA0001 (Initial Access) through the CSRF delivery mechanism, and TA0043 (Reconnaissance) for exploitation preparation. Practitioners using Casky would observe findings highlighting suspicious POST requests lacking proper nonce validation, unsanitized user input flowing into SQL queries, and PHP object deserialization patterns. The platform would flag the behavioral signature of bulk action processing without authentication tokens, combined with SQL injection payloads and object injection attempts, enabling security teams to identify both active exploitation attempts and vulnerable plugin instances before attackers can weaponize them.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-6455.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-6455

Casky has 301 skills that investigate the attack patterns behind CVE-2026-6455. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn