The vulnerability identified as CVE-2026-0825 affects the Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress. It is caused by missing authorization checks on the CSV export endpoint, allowing unauthenticated attackers to access and download all form submission data by using an export key exposed in publicly accessible page source code. While the plugin's shortcode properly restricts data display based on user permissions, the CSV export handler bypasses these restrictions, leading to unauthorized data exposure. This issue impacts all versions up to and including 1.4.5. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

An attacker can obtain sensitive personally identifiable information (PII) submitted via forms by exploiting the missing authorization checks on the CSV export functionality. This unauthorized data access could lead to privacy violations and potential misuse of exposed information. There is no indication of data modification or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the CSV export endpoint and avoid exposing export keys in publicly accessible page source code. Monitor for vendor updates and apply patches promptly once released.