Atomic Edge analysis of CVE-2026-9145:
This vulnerability is an unauthenticated arbitrary file copy/upload vulnerability in the Database for Contact Form 7, WPforms, Elementor forms plugin (versions up to and including 1.5.1). The flaw resides in the create_entry_el() function, which processes Elementor Pro form submissions. An unauthenticated attacker can cause the plugin to copy arbitrary files from the server or from remote URLs into a plugin-managed upload directory, potentially leading to sensitive file disclosure. The CVSS score is 6.5.
Root Cause: The vulnerable code is in contact-form-entries/contact-form-entries.php, within the create_entry_el() function. At line 640 (pre-patch), the code reads $val=$v[‘raw_value’] for upload-type fields. For Elementor Pro forms, the ‘raw_value’ comes from the Form_Record object. An attacker can control this value by sending a POST request with a crafted ‘raw_value’ string (e.g., a path like /etc/passwd or a remote URL like http://attacker.com/shell.php). When no actual file is present in $_FILES, the code passes this attacker-controlled string directly to the copy() function at line 716 (in copy_files). The copy() function in PHP accepts both local filesystem paths and URL sources (if allow_url_fopen is enabled). The destination directory path is generated using uniqid() and rand(), but is partially guessable. The bug is entirely in the Contact Form Entries handler; Elementor Pro provides the hook that populates the Form_Record object.
Exploitation: An attacker sends a POST request to a WordPress site with Elementor Pro and the vulnerable plugin active. The request targets an Elementor Pro form submission endpoint (typically /wp-json/elementor-pro/v1/forms/submissions or similar). The attacker includes a form field of type ‘upload’ (or ‘file’) with the ‘raw_value’ parameter set to a target file path (e.g., file:///etc/passwd, ../../../../wp-config.php, or a remote URL like http://evil.com/shell.php). The plugin processes the submission, extracts the ‘raw_value’, and copies it to the upload directory. The attacker then needs to determine the hashed directory name to locate the copied file. The directory name is generated as ‘crm_perks_uploads/’ . uniqid() . ‘_’ . rand(), which provides some obscurity but is not cryptographically secure. The attacker can iterate through possible directory names or use other information leaks to find the file.
Patch Analysis: The patch makes two key changes. First, at line 637 (post-patch), it adds $raw_files = $record->get( ‘files’ ) which retrieves the actual file metadata from the Elementor Pro Form_Record. Second, at line 640, it now checks if the field type is ‘upload’ or ‘file’ AND if $raw_files[$v[‘id’]] exists with a ‘path’ key. If so, it uses $raw_files[$v[‘id’]][‘path’] (the legitimate uploaded file path) instead of $v[‘raw_value’] (the attacker-controlled string). This ensures only files that Elementor Pro has already validated as legitimate uploads are processed by the copy_files() function. The patch effectively prevents the attacker from injecting arbitrary file paths or URLs by requiring that the file reference come from Elementor Pro’s validated file storage rather than from the raw form field value.
Impact: An authenticated attacker can exploit this vulnerability to copy arbitrary files readable by the web server to the plugin’s upload directory. This includes sensitive files like wp-config.php, /etc/passwd, and other configuration or system files. If the attacker can also enumerate the hashed directory name, they can read the contents of these files, leading to sensitive information disclosure. In scenarios where allow_url_fopen is enabled, the attacker can also copy remote files (like webshells) to the server, potentially leading to remote code execution. The copying itself does not require authentication, making it accessible to any unauthenticated visitor who can submit an Elementor Pro form.
