Authorization Bypass in Contact Form 7 and Elementor Forms Plugin by WordPress

CVE-2026-0825

What is CVE-2026-0825?

The affected WordPress plugins for contact forms permit unauthorized individuals to download sensitive data due to inadequate capability checks on the CSV export function. This flaw allows attackers to access the CSV export endpoint and retrieve confidential form submission data containing personally identifiable information (PII). While the plugin's standard user interface filters entries according to user privileges, the underlying CSV export mechanism neglects these checks, resulting in a full export of all data, regardless of the requester’s permissions. This highlights significant weaknesses in data protection and user authorization within these plugins.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References