🔐 CVE Alert

CVE-2026-40769

HIGH 8.6

WordPress Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field plugin <= 1.0.6 - Arbitrary File Deletion vulnerability

CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th

Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi &#8211; Save Entries, File Upload &amp; Country Code Field <= 1.0.6 versions.

CWE CWE-22
Vendor satinder singh
Product contact form extender for divi &#8211; save entries, file upload &amp; country code field
Published Jun 15, 2026
Stay Ahead of the Next One

Get instant alerts for satinder singh contact form extender for divi &#8211; save entries, file upload &amp; country code field

Be the first to know when new high vulnerabilities affecting satinder singh contact form extender for divi &#8211; save entries, file upload &amp; country code field are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Affected Versions

Satinder Singh / Contact Form Extender for Divi &#8211; Save Entries, File Upload &amp; Country Code Field
n/a ≤ 1.0.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗
patchstack.com: https://patchstack.com/database/wordpress/plugin/contact-form-extender-for-divi-builder/vulnerability/wordpress-contact-form-extender-for-divi-save-entries-file-upload-country-code-field-plugin-1-0-6-arbitrary-file-deletion-vulnerability?_s_id=cve

Credits

babyhack(@OPCIA) | Patchstack Bug Bounty Program