The vulnerability allows a logged‑in administrator to have form entries removed without their consent. By omitting the CSRF nonce, the plugin does not verify the request and it also lacks any capability check, so a crafted page that the admin visits triggers a delete operation on arbitrary entries. The result is loss of data integrity and availability of the form records.

WordPress sites running the Database Addon for WPForms plugin before version 1.1.1 are affected. The plugin stores form submission records and the vulnerability lies in its entries management module.

The CVSS score is 4.3, indicating a moderate risk. The lack of CSRF protection and missing capability verification give a moderate to high risk for authenticated administrators. An attacker must be able to lure an admin into loading a crafted URL. The EPSS score is 0.00097, indicating a very low probability of exploitation, but the vulnerability is still exploitable under the described conditions. The plugin is not listed in the CISA KEV catalog.