WordPress · Wpforms · CVE-2026-3831
Name of the Vulnerable Software and Affected Versions
Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions through 1.4.9
Description
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is susceptible to unauthorized data access. This is due to a missing capability check within the `entries shortcode()` function. Authenticated attackers with Contributor-level access or higher can extract all form submissions, including sensitive information such as names, email addresses, and phone numbers.
Recommendations
Versions prior to 1.5.0 should be updated.