CVE-2021-24905

CVE-2021-24905 describes a critical vulnerability in the Advanced Contact Form 7 DB WordPress plugin versions prior to 1.8.7. This flaw allows any authenticated user to delete arbitrary files on the web server due to missing authorization, CSRF checks, and file validation in an AJAX action. The vulnerability carries a CVSS score of 8.0 (High), indicating a significant risk of complete compromise of confidentiality, integrity, and availability, as an attacker could delete critical files like wp-config.php to gain administrative control and execute arbitrary code. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.