The Contact Form Entries plugin for WordPress, specifically the crmperks Database integration for Contact Form 7, WPforms, and Elementor forms, suffers from an unrestricted file upload vulnerability (CWE-434) in the 'view_page' function. Authenticated attackers with administrator privileges can upload arbitrary files without proper validation, potentially leading to remote code execution. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with administrator-level access to upload arbitrary files to the server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site and its data. The vulnerability requires high privileges but can have severe consequences if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from crmperks regarding patches or mitigations.