Contact Form By Wpforms CVE-2026-32446

The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N vector indicates a network-exploitable flaw requiring low privileges, low complexity, with confidentiality impact limited to the user's scope—a moderate but real risk. The low CVSS score (4.3) reflects the requirement for authentication and limited confidentiality impact; however, this understates real-world risk for WordPress deployments where authenticated users are common and form data often contains personally identifiable information (PII). The vulnerability is not reported in the CISA KEV catalog (as of this analysis), suggesting it has not been actively exploited at scale or is not yet widely known. Without explicit EPSS data or POC availability, the exploitation probability appears lower than critical flaws, but the simplicity of the attack vector (network, no interaction) and the ubiquity of WPForms (millions of installations) mean opportunistic attacks remain plausible. Organizations with strict user access policies and forms containing PII should prioritize patching; those with tight authentication controls may defer slightly but should not ignore this issue.

An authenticated user with basic permissions (e.g., a contributor or subscriber) logs into a WordPress site running vulnerable WPForms and navigates to form endpoints they should not access. Due to missing authorization checks, the plugin grants them read access to form data, including PII submitted by other users. The attacker can enumerate forms, view submission details, or extract exported datasets—all without administrative privileges or elevated access. No user interaction is required beyond standard authentication, making this exploitable at scale across WordPress multisite deployments or shared hosting environments with many users.