Technical impact
The database plugin allows administrators to export form submissions as CSV files. However, the export handler skips the authorization check performed by the shortcode that normally limits entry visibility, enabling anyone who can access the export endpoint to download all entries. Because the export key is embedded in publicly reachable page source, an attacker with no credentials can trigger the download and obtain personally identifiable information stored in the plugin’s database. This flaw translates directly to an unauthenticated data exfiltration vulnerability.
Affected Systems
WordPress sites using the Database for Contact Form 7, WPforms, Elementor forms plugin from crmperks, specifically any release up through and including version 1.4.5, are impacted. No other product or version data is listed, so all installations of 1.4.5 or earlier are considered vulnerable until a fix is applied.
Risk and Exploitability
CVE‑2026‑0825 receives a CVSS base score of 5.3, indicating moderate severity. The EPSS is reported as less than 1 %, suggesting that at the time of this analysis exploitation was unlikely in the wild, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Nevertheless, the missing authorization bypass is a straightforward attack path that requires only access to the exposed export key, which is discoverable in the public template code. Attackers can initiate the export from any user‑level context without authenticating, potentially exposing all collected PII.
