CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers.
Explanation of Vulnerability in Simple Terms
The Database for Contact Form 7, WPforms, and Elementor forms plugin for WordPress does not properly check user permissions before allowing access to stored form data. A logged-in user with low privileges can view contact form submissions and other data they should not have access to. Update to a version newer than 1.4.9.
What an attacker can do
View contact form submissions and stored data belonging to other users or forms.
Potential impact on your site
Visitor and customer data from contact forms may be exposed to unauthorized WordPress users.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
