What is the CVSS score of EUVD-2026-17763?

EUVD-2026-17763 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2026-17763

| CVE-2026-3831 MEDIUM

Missing Authorization (CWE-862)

2026-04-01 Wordfence

WordPress Authentication Bypass Elementor

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 01:45 euvd

EUVD-2026-17763

Analysis Generated

Apr 01, 2026 - 01:45 vuln.today

CVE Published

Apr 01, 2026 - 01:24 nvd

MEDIUM 4.3

DescriptionCVE.org

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers.

AnalysisAI

Authenticated attackers with Contributor-level access or above can extract all form submissions from the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin (versions up to 1.4.9) via a missing capability check in the entries_shortcode() function, exposing names, emails, phone numbers, and other sensitive form data. The vulnerability requires existing WordPress user credentials but no administrative privileges, making it accessible to low-privileged users who may be granted contributor roles during normal site operations. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

This vulnerability stems from a missing capability check (CWE-862: Missing Authorization) in the entries_shortcode() function within the Database for Contact Form 7, WPforms, Elementor Forms plugin. The shortcode handler processes form entry retrieval without verifying that the requesting user possesses the necessary WordPress capabilities to access sensitive form submission data. WordPress capability checks (using functions like current_user_can()) are the standard authorization mechanism for controlling access to sensitive operations. The affected plugin (CPE: cpe:2.3:a:crmperks:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:*) implements shortcodes that retrieve stored form entries from the database, but fails to validate whether the authenticated user is authorized to view such data, allowing any authenticated WordPress user at Contributor level or above to bypass intended access controls and read form submission records.

RemediationAI

Update the Database for Contact Form 7, WPforms, Elementor Forms plugin to version 1.4.10 or later immediately. WordPress site administrators should navigate to Plugins > Installed Plugins, locate the plugin, and click Update if available. If automatic updates are not configured, download the latest version from the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/contact-form-entries/) or via the WordPress dashboard. As an interim workaround pending patching, administrators should audit and restrict Contributor-level access to only trusted users, or temporarily disable the plugin if form submission data confidentiality is a critical concern. For sites using the shortcode functionality, review which users have contributor permissions and consider demoting unnecessary contributors to Subscriber role. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a033ea44-8084-44c1-8e24-bdb1b61c3566?source=cve) for additional context and any supplemental hardening recommendations.