The EleForms plugin for WordPress suffers from a CSRF vulnerability (CWE-352) due to improper nonce validation on the deletion of form submissions. This allows unauthenticated attackers to perform deletion actions if they can induce an authenticated administrator to execute a crafted request, such as clicking a malicious link. The vulnerability affects all plugin versions up to and including 2.9.9.9. The CVSS 3.1 base score is 4.3, reflecting low complexity and no required privileges but requiring user interaction. There is no vendor advisory or patch currently available, and no known exploitation has been reported.

An attacker can cause an authenticated site administrator to unknowingly delete form submissions by exploiting the CSRF vulnerability. This results in integrity loss of form submission data but does not affect confidentiality or availability. The impact is limited to unauthorized data modification through deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links and consider implementing additional CSRF protections or disabling the affected functionality if feasible.