CVE-2026-105260 in Database Addon for WPForms Plugin
Summary
by MITRE • 10/08/2026
The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafted page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in versions of the Database Addon For WPForms prior to version 1.1.1 represents a critical failure in access control and request validation mechanisms within the WordPress ecosystem. This plugin, which extends the functionality of the popular WPForms suite by allowing administrators to store form submissions directly into custom database tables, suffers from two distinct but related security flaws: Cross-Site Request Forgery (CSRF) due to missing nonce verification and Broken Access Control resulting from insufficient capability checks. These deficiencies collectively allow an unauthenticated or low-privileged attacker to perform state-changing actions on behalf of a privileged user without their consent or knowledge. The core issue lies in the plugin's handling of delete operations for stored form entries, where the backend logic fails to enforce standard WordPress security protocols required for modifying data.
From a technical perspective, the vulnerability stems from the absence of CSRF nonce verification when specific fields are omitted during the request process. In secure web applications, particularly those built on frameworks like WordPress, any action that modifies server-side state must be protected by a unique, time-sensitive token known as a nonce. This mechanism ensures that the request originated from a legitimate source within the application context rather than being forged by an external malicious site. The flaw in this plugin indicates that if certain parameters are missing or structured in a specific way, the validation routine is bypassed entirely. Furthermore, the code does not perform its own capability check to verify whether the current user has the necessary permissions to delete entries. While WordPress core functions often handle some of these checks automatically when used correctly, custom database interactions frequently require explicit verification using functions such as current_user_can or similar permission gates. The lack of this internal validation means that any logged-in administrator, regardless of their actual role or intent, can trigger the deletion logic if they are tricked into making a request to the vulnerable endpoint.
The operational impact of this vulnerability is severe for organizations relying on WPForms and its database addon for collecting sensitive data such as customer inquiries, job applications, or financial information stored in form entries. An attacker can craft a malicious webpage containing an image tag or a hidden form that points to the plugin's delete entry endpoint with the appropriate parameters. When a logged-in administrator visits this page while authenticated to their WordPress dashboard, the browser will automatically include session cookies and other authentication credentials with the request. Consequently, the server processes the deletion command as if it were authorized by the administrator. This results in the irreversible loss of critical data stored within the custom database tables managed by the plugin. Beyond the immediate data loss, this can lead to significant operational disruption, compliance violations regarding data retention policies, and a breach of trust with users whose information was contained in those forms. The ability to delete arbitrary entries also undermines the integrity of audit trails and historical records that organizations may depend on for legal or business analysis purposes.
This vulnerability aligns closely with several recognized industry standards and threat classifications. It is primarily categorized under CWE-352, which describes Cross-Site Request Forgery, due to the lack of anti-CSRF tokens preventing unauthorized state changes. Additionally, it falls under CWE-862, Missing Authorization Check, because the application fails to verify that the user has the required privileges for the action being performed. In terms of offensive security tactics, this exploit maps directly to MITRE ATT&CK technique T1534, which covers Internal Spearphishing or Social Engineering via malicious links designed to trigger actions in authenticated sessions. The attack vector is classified as remote with low complexity and requires user interaction, specifically the victim loading a crafted page while logged into their WordPress admin area.
To mitigate this vulnerability, immediate action must be taken by updating the Database Addon For WPForms plugin to version 1.1.1 or later, where these security flaws have been addressed. Developers should ensure that all state-changing endpoints implement robust CSRF protection using nonces generated and verified via standard WordPress functions like wp_verify_nonce. Furthermore, explicit capability checks must be integrated into every custom database operation to guarantee that only users with the appropriate roles, such as administrators or specific form managers, can execute delete commands. Regular security audits of third-party plugins are essential to identify similar patterns where convenience overrides security best practices. Administrators should also monitor their WordPress logs for unusual deletion activity and consider implementing additional layers of defense such as Web Application Firewalls that can detect anomalous request patterns indicative of CSRF attacks.