CVE-2026-18594
MediumCVSS 4.3Summary
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.1.3. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with custom-level access or above to import forged CSV submission records into any Contact Form 7 form.
Risk Assessment
An attacker can inject fake submission data into forms, potentially leading to data poisoning, spam, or manipulation of form-based business processes.
Recommendation
Update the Advanced Contact form 7 DB plugin to a version newer than 2.1.3. Until then, restrict access to the import functionality and verify user permissions.
Other vulnerabilities in Advanced Contact form 7 DB
See all- CVE-2026-57669Medium
The Advanced Contact form 7 DB plugin version 2.0.9 and earlier contains a broken access control vulnerability exploitable by subscribers. A user with the subscriber role can gain unauthorized access to functions intended for administrators.
- CVE-2026-0814Medium
The Advanced Contact form 7 DB plugin for WordPress up to version 2.0.9 lacks proper capability checks in the 'vsz_cf7_export_to_excel' function. This allows authenticated attackers with Subscriber-level access or higher to export form submissions to an Excel file.
Original NVD description (English source)
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.