CVE-2026-0814
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Advanced Contact form 7 DB plugin for WordPress up to version 2.0.9 lacks proper capability checks in the 'vsz_cf7_export_to_excel' function. This allows authenticated attackers with Subscriber-level access or higher to export form submissions to an Excel file.
Risk Assessment
The organization risks data leakage of information collected via contact forms, which may include sensitive user data.
Recommendation
Immediately update the Advanced Contact form 7 DB plugin to the latest version that includes the missing access control fix.
Other vulnerabilities in Advanced Contact form 7 DB
See all- CVE-2026-57669Medium
The Advanced Contact form 7 DB plugin version 2.0.9 and earlier contains a broken access control vulnerability exploitable by subscribers. A user with the subscriber role can gain unauthorized access to functions intended for administrators.
- CVE-2026-6831Medium
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the 'acf7db' shortcode.
- CVE-2026-18594Medium
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.1.3. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with custom-level access or above to import forged CSV submission records into any Contact Form 7 form.
Original NVD description (English source)
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in all versions up to, and including, 2.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export form submissions to excel file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS