PT-2026-5066 · Wpforms+2 · Wpforms+2

Teerachai Somprasong · Publicado 2026-01-28 · Atualizado 2026-01-28 · CVE-2026-0825

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions up to and including 1.4.5

Description The plugin has an authorization bypass due to missing capability checks on the CSV export functionality. This allows unauthenticated attackers to download sensitive form submission data, including personally identifiable information (PII), by accessing the CSV export endpoint. The export key needed for this access is exposed in the publicly accessible page source code. The CSV export handler bypasses user permission filtering, exporting all entries regardless of user roles.

Recommendations Versions prior to 1.4.5 should be updated.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-0825

Produtos afetados

Database For Contact Form 7

Elementor Forms Plugin

Wpforms

Referências · 10

• https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/templates/leads-table.php#L10 · Nota
• https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L76 · Nota
• https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L301 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/4048ae11-fece-42aa-baf3-c636c4875635?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-0825 · Nota de Segurança
• https://t.me/cveNotify/150089 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442962%40contact-form-entries&new=3442962%40contact-form-entries&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.5/contact-form-entries.php#L76 · Nota
• https://t.me/CVEtracker/43109 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2016414569585922187 · Publicação no Twitter