CVE Explorer
CVE-2026-0825
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to download sensitive form submission data containing personally identifiable information (PII) by accessing the CSV export endpoint with an export key that is exposed in publicly accessible page source code. The vulnera
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Database for Contact Form 7, WPforms, Elementor forms","vendor":"crmperks","versions":[{"lessThanOrEqual":"1.4.5","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:4801026b76c606b9cd96323eeff946f23afe1733b5bd65824bf70f190dc4f9be · sha256:a1145ade539dd9e9… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:4801026b76c606b9cd96323eeff946f23afe1733b5bd65824bf70f190dc4f9be · sha256:a1145ade539dd9e9… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:4801026b76c606b9cd96323eeff946f23afe1733b5bd65824bf70f190dc4f9be · sha256:a1145ade539dd9e9… · /containers/cna/problemTypes/0/descriptions/0
Source references
6 source assertions{"url":"https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.5/contact-form-entries.php#L76"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4801026b76c606b9cd96323eeff946f23afe1733b5bd65824bf70f190dc4f9be · sha256:a1145ade539dd9e9… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L301"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4801026b76c606b9cd96323eeff946f23afe1733b5bd65824bf70f190dc4f9be · sha256:a1145ade539dd9e9… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php#L76"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4801026b76c606b9cd96323eeff946f23afe1733b5bd65824bf70f190dc4f9be · sha256:a1145ade539dd9e9… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/templates/leads-table.php#L10"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4801026b76c606b9cd96323eeff946f23afe1733b5bd65824bf70f190dc4f9be · sha256:a1145ade539dd9e9… · /containers/cna/references/4
{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442962%40contact-form-entries&new=3442962%40contact-form-entries&sfp_email=&sfph_mail="}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4801026b76c606b9cd96323eeff946f23afe1733b5bd65824bf70f190dc4f9be · sha256:a1145ade539dd9e9… · /containers/cna/references/5
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4048ae11-fece-42aa-baf3-c636c4875635?source=cve"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4801026b76c606b9cd96323eeff946f23afe1733b5bd65824bf70f190dc4f9be · sha256:a1145ade539dd9e9… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.