WPForms Database Addon EUVD-2026-94746

Exploitation requires an authenticated WordPress administrator with an active session to be tricked (UI:R) into loading an attacker-controlled page while logged in; the vulnerable entry-deletion handler in Database Addon For WPForms before 1.1.1 does not validate the CSRF nonce when the field is omitted and performs no capability check, so no credentials or configuration changes are needed by the attacker. Limiting factors: the attack only succeeds against sites running this specific addon at a vulnerable version, depends on social-engineering a privileged user, and impact is confined to deletion of stored form entries (no confidentiality or availability loss, no code execution).

This is a CSRF flaw (CWE-352) with a vendor-assigned CVSS of 4.3 and an independently consistent vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - network-reachable and low-complexity, but gated on user interaction (UI:R) by a logged-in administrator and limited to integrity-only impact (C:N/I:L/A:N), which explains the Medium rather than High rating. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The realistic priority is moderate-to-low: the technical impact is bounded (deletion of stored form entries, not code execution or data disclosure), and successful attack requires social-engineering an authenticated admin into visiting a crafted page. One caveat: PR:N reflects that the attacker needs no credentials, but the attack still depends entirely on an administrator session, so the UI:R factor is the true limiting condition - raw 'network/unauthenticated' framing overstates reach. A patch is confirmed available, making remediation straightforward.

An attacker crafts a malicious web page (or email link) containing a hidden request that triggers the plugin's entry-deletion action, which omits the CSRF nonce field and performs no capability check. When a logged-in WordPress administrator is lured into loading that page, their authenticated browser silently issues the delete request, removing arbitrary stored WPForms entries. No public exploit code is identified at time of analysis, but AC:L and the omitted nonce make the request trivial to forge.