CVE-2026-3831

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3831", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-09T13:37:57.000Z", "datePublished": "2026-04-01T01:24:20.558Z", "dateUpdated": "2026-04-08T17:12:10.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:10.218Z"}, "affected": [{"vendor": "crmperks", "product": "Database for Contact Form 7, WPforms, Elementor forms", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers."}], "title": "Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a033ea44-8084-44c1-8e24-bdb1b61c3566?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.8/contact-form-entries.php#L204"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Qu\u1ed1c Huy"}], "timeline": [{"time": "2026-03-01T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-03-09T13:53:46.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-31T12:23:38.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:13:40.091778Z", "id": "CVE-2026-3831", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:13:46.475Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3831", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T13:13:40.091778Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:13:43.007Z"}}], "cna": {"title": "Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Qu\u1ed1c Huy"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "crmperks", "product": "Database for Contact Form 7, WPforms, Elementor forms", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-01T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-03-09T13:53:46.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-31T12:23:38.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a033ea44-8084-44c1-8e24-bdb1b61c3566?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.8/contact-form-entries.php#L204"}], "descriptions": [{"lang": "en", "value": "The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:10.218Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3831", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:12:10.218Z", "dateReserved": "2026-03-09T13:37:57.000Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-01T01:24:20.558Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Database for Contact Form 7, WPforms, Elementor forms", "vendor": "crmperks", "versions": [{"lessThanOrEqual": "1.4.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers."}, {"lang": "es", "value": "El plugin Database for Contact Form 7, WPforms, Elementor forms para WordPress es vulnerable a acceso no autorizado de datos debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n entries_shortcode() en todas las versiones hasta la 1.4.9, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, extraigan todos los env\u00edos de formulario, incluyendo nombres, correos electr\u00f3nicos y n\u00fameros de tel\u00e9fono."}], "id": "CVE-2026-3831", "lastModified": "2026-06-17T10:44:18.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3831", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T13:13:40.091778Z", "version": "2.0.3"}}]}, "published": "2026-04-01T02:16:03.357", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.8/contact-form-entries.php#L204"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a033ea44-8084-44c1-8e24-bdb1b61c3566?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.9]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Database for Contact Form 7, WPforms, Elementor forms", "source": "cna", "vendor": "crmperks"}, "product": "database_for_contact_form_7,_wpforms,_elementor_forms", "vendor": "crmperks"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-01T06:29:19.103720+00:00", "value": {"mitigation_remediation": ["Update Database for Contact Form 7, WPforms, and Elementor forms to the latest secure release (versions after 1.4.9).", "If an immediate update is not possible, restrict the use of the entries_shortcode() function to Administrator\u2011only users or remove it entirely from public shortcodes.", "Review role assignments and revoke Contributor access from users who do not need to view form entries.", "Audit existing shortcodes for exposed endpoints and ensure that only authorized roles can influence them."], "summary": {"action": "Update Plugin", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "The issue affects the Database for Contact Form 7, WPforms, and Elementor forms plugin for WordPress, specifically all releases up to and including version 1.4.9. Sites using this plugin to capture contact form data are at risk, regardless of the overall WordPress installation version.", "description_and_impact": "The vulnerable plugin performs a missing capability check in the entries_shortcode() function, allowing any authenticated user with Contributor level or higher to retrieve all form submissions, including names, email addresses, and phone numbers. The flaw exposes sensitive personally identifying information without any external code execution or denial of service impact. This weakness is classified as a missing authorization (CWE\u2011862).", "risk_and_exploitability": "With a CVSS base score of 4.3, the vulnerability is considered medium severity. Exploitation requires only authenticated access at the Contributor role or higher, which is commonly granted on many sites. Because the attacker does not need to bypass additional authentication layers, the risk to user data is significant if the role is improperly assigned. The issue is not listed in CISA's KEV catalog and no EPSS score is available, but the straightforward exploitation path suggests a moderate likelihood of attack."}}}}, "created": "2026-04-02T07:50:28.894240+00:00", "updated": "2026-04-02T20:18:35.334829+00:00", "vendors": ["crmperks", "crmperks$PRODUCT$database_for_contact_form_7,_wpforms,_elementor_forms", "wordpress", "wordpress$PRODUCT$wordpress"]}