CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when downloading form submissions in all versions up to, and including, 2.9.9.7. This makes it possible for unauthenticated attackers to view form submissions.
Explanation of Vulnerability in Simple Terms
EleForms for Elementor versions up to 2.9.9.7 fail to properly check user permissions before allowing access to sensitive data. An unauthenticated attacker can read information that should be restricted, such as form submissions or configuration details. Update to a version newer than 2.9.9.7 to resolve this issue.
What an attacker can do
Read sensitive form data and configuration without logging in.
Potential impact on your site
Visitor form submissions and plugin settings may be exposed to the public.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
