blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-0825

MEDIUM 5.3 CVSS 3.1
Published
January 28, 2026
Last modified
June 17, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to download sensitive form submission data containing personally identifiable information (PII) by accessing the CSV export endpoint with an export key that is exposed in publicly accessible page source code. The vulnerability is created because while the shortcode properly filters displayed entries by user, the CSV export handler completely bypasses this filtering and exports all entries regardless of user permissions.

Affected WordPress components

  • Database for Contact Form 7, WPforms, Elementor forms Plugin · contact-form-entries
    Confirmed match Active
    Up to and including 1.4.5
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • crmperks Database for Contact Form 7, WPforms, Elementor forms — Up to and including 1.4.5

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.5/contact-form-entries.php#L76
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L301
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L76
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/templates/leads-table.php#L10
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442962%40contact-form-entries&new=3442962%40contact-form-entries&sfp_email=&sfph_mail=
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/4048ae11-fece-42aa-baf3-c636c4875635?source=cve
  • nvd.nist.gov Official NVD record