CVE-2026-105260 WPForms CVE debrief

Who should care

Administrators of WordPress installations using the Database Addon For WPForms plugin should be aware of this vulnerability and take steps to mitigate it. They should verify that they are running version 1.1.1 or later to mitigate this vulnerability. Additionally, security teams and vulnerability management teams should review the vulnerability and implement compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

The Database Addon For WPForms WordPress plugin before version 1.1.1 is vulnerable to arbitrary form entry deletion via CSRF. Administrators should verify that they are running version 1.1.1 or later to mitigate this vulnerability.

• Attackers can delete arbitrary form entries, potentially leading to data loss.
• Successful exploitation requires tricking a logged-in administrator into loading a crafted page.
• The vulnerability exists due to the lack of CSRF nonce verification and capability checks.

Technical summary

The Database Addon For WPForms WordPress plugin before version 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own. This allows attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafted page. The vulnerability exists due to the lack of CSRF nonce verification and capability checks in the plugin. Successful exploitation requires tricking a logged-in administrator into loading a crafted page, potentially leading to data loss.

Defensive priority

Administrators of WordPress installations using the Database Addon For WPForms plugin should verify that they are running version 1.1.1 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify that the Database Addon For WPForms plugin is updated to version 1.1.1 or later.
• Implement CSRF protection for form entries.
• Restrict access to form entry deletion functionality to authorized users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists due to the lack of CSRF nonce verification and capability checks in the Database Addon For WPForms plugin. This allows attackers to delete arbitrary form entries by tricking administrators into loading a crafted page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.