CVE-2026-0825

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0825", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-09T18:47:18.941Z", "datePublished": "2026-01-28T06:43:42.726Z", "dateUpdated": "2026-04-08T16:48:22.116Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:22.116Z"}, "affected": [{"vendor": "crmperks", "product": "Database for Contact Form 7, WPforms, Elementor forms", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to download sensitive form submission data containing personally identifiable information (PII) by accessing the CSV export endpoint with an export key that is exposed in publicly accessible page source code. The vulnerability is created because while the shortcode properly filters displayed entries by user, the CSV export handler completely bypasses this filtering and exports all entries regardless of user permissions."}], "title": "Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4048ae11-fece-42aa-baf3-c636c4875635?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.5/contact-form-entries.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L301"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/templates/leads-table.php#L10"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442962%40contact-form-entries&new=3442962%40contact-form-entries&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Teerachai Somprasong"}], "timeline": [{"time": "2026-01-09T19:02:29.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-27T17:44:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T15:01:52.410179Z", "id": "CVE-2026-0825", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T15:02:15.499Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0825", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T15:01:52.410179Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T15:02:09.600Z"}}], "cna": {"title": "Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export", "credits": [{"lang": "en", "type": "finder", "value": "Teerachai Somprasong"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "crmperks", "product": "Database for Contact Form 7, WPforms, Elementor forms", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-09T19:02:29.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-27T17:44:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4048ae11-fece-42aa-baf3-c636c4875635?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.5/contact-form-entries.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L301"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/templates/leads-table.php#L10"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442962%40contact-form-entries&new=3442962%40contact-form-entries&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to download sensitive form submission data containing personally identifiable information (PII) by accessing the CSV export endpoint with an export key that is exposed in publicly accessible page source code. The vulnerability is created because while the shortcode properly filters displayed entries by user, the CSV export handler completely bypasses this filtering and exports all entries regardless of user permissions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:22.116Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0825", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:48:22.116Z", "dateReserved": "2026-01-09T18:47:18.941Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-28T06:43:42.726Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Database for Contact Form 7, WPforms, Elementor forms", "vendor": "crmperks", "versions": [{"lessThanOrEqual": "1.4.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to download sensitive form submission data containing personally identifiable information (PII) by accessing the CSV export endpoint with an export key that is exposed in publicly accessible page source code. The vulnerability is created because while the shortcode properly filters displayed entries by user, the CSV export handler completely bypasses this filtering and exports all entries regardless of user permissions."}, {"lang": "es", "value": "El plugin Database para Contact Form 7, WPforms, formularios de Elementor para WordPress es vulnerable a una elusi\u00f3n de autorizaci\u00f3n debido a la falta de comprobaciones de capacidad en la funcionalidad de exportaci\u00f3n CSV en todas las versiones hasta la 1.4.5, ambas inclusive. Esto hace posible que atacantes no autenticados descarguen datos sensibles de env\u00edo de formularios que contienen informaci\u00f3n de identificaci\u00f3n personal (PII) al acceder al endpoint de exportaci\u00f3n CSV con una clave de exportaci\u00f3n que est\u00e1 expuesta en el c\u00f3digo fuente de la p\u00e1gina accesible p\u00fablicamente. La vulnerabilidad se crea porque, mientras que el shortcode filtra correctamente las entradas mostradas por usuario, el manejador de exportaci\u00f3n CSV elude completamente este filtrado y exporta todas las entradas independientemente de los permisos del usuario."}], "id": "CVE-2026-0825", "lastModified": "2026-06-17T10:11:26.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0825", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T15:01:52.410179Z", "version": "2.0.3"}}]}, "published": "2026-01-28T07:16:00.133", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.5/contact-form-entries.php#L76"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L301"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L76"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/templates/leads-table.php#L10"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442962%40contact-form-entries&new=3442962%40contact-form-entries&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4048ae11-fece-42aa-baf3-c636c4875635?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T19:00:49.033934+00:00", "value": {"mitigation_remediation": ["Update the plugin to the latest available version (\u2265\u202f1.4.6) where the capability check has been re\u2011implemented.", "Until an update can be installed, remove or protect the CSV export endpoint by restricting it to administrator users, or configure the server to block the /export endpoint for unauthenticated requests.", "After applying the patch or restriction, review the source to confirm that the export key is no longer present in publicly accessible templates and validate that the export functionality now requires the appropriate capability before generating the CSV."], "summary": {"action": "Patch Now", "impact": "Unauthenticated Data Exfiltration"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Database for Contact Form 7, WPforms, Elementor forms plugin from crmperks, specifically any release up through and including version\u202f1.4.5, are impacted. No other product or version data is listed, so all installations of 1.4.5 or earlier are considered vulnerable until a fix is applied.", "description_and_impact": "The database plugin allows administrators to export form submissions as CSV files. However, the export handler skips the authorization check performed by the shortcode that normally limits entry visibility, enabling anyone who can access the export endpoint to download all entries. Because the export key is embedded in publicly reachable page source, an attacker with no credentials can trigger the download and obtain personally identifiable information stored in the plugin\u2019s database. This flaw translates directly to an unauthenticated data exfiltration vulnerability.", "risk_and_exploitability": "CVE\u20112026\u20110825 receives a CVSS base score of 5.3, indicating moderate severity. The EPSS is reported as less than\u202f1\u202f%, suggesting that at the time of this analysis exploitation was unlikely in the wild, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Nevertheless, the missing authorization bypass is a straightforward attack path that requires only access to the exposed export key, which is discoverable in the public template code. Attackers can initiate the export from any user\u2011level context without authenticating, potentially exposing all collected PII."}}}}, "created": "2026-01-29T09:18:19.844209+00:00", "updated": "2026-04-15T19:15:12.062996+00:00", "vendors": ["crmperks", "crmperks$PRODUCT$database_for_contact_form_7,_wpforms,_elementor_forms", "wordpress", "wordpress$PRODUCT$wordpress"]}