PT-2026-29441 · WordPress · Wpforms+2

Quốc Huy · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-3831

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions through 1.4.9

Description The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is susceptible to unauthorized data access. This is due to a missing capability check within the entries shortcode() function. Authenticated attackers with Contributor-level access or higher can extract all form submissions, including sensitive information such as names, email addresses, and phone numbers.

Recommendations Versions prior to 1.5.0 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3831

Affected Products

Database For Contact Form 7

Elementor Forms

Wpforms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-3831 · Security Note
• https://twitter.com/CVEarity/status/2039307170228183173 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a033ea44-8084-44c1-8e24-bdb1b61c3566?source=cve · Note
• https://twitter.com/CVEnew/status/2039279692960944377 · Twitter Post
• https://twitter.com/cyberbivash/status/2039182722011177110 · Twitter Post
• https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.8/contact-form-entries.php#L204 · Note