The vulnerability CVE-2026-25320 affects the Elementor Contact Form DB plugin by Cool Plugins, specifically versions up to 2.1.3. It is a missing authorization issue where access control is improperly configured, allowing unauthenticated remote attackers to perform actions that could alter data integrity. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to integrity. No patch or vendor advisory is available to confirm remediation status.

Exploitation of this vulnerability could allow an unauthenticated attacker to modify data within the Elementor Contact Form DB plugin, impacting data integrity. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to the Elementor Contact Form DB plugin. Avoid exposing the plugin to untrusted networks where possible.