CVE-2026-6831
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the 'acf7db' shortcode.
Risk Assessment
An authenticated attacker with low privileges can access all data submitted through Contact Form 7 forms, potentially leading to leakage of sensitive information. This constitutes a breach of confidentiality of personal and business data.
Recommendation
Update the Advanced Contact form 7 DB plugin to a version later than 2.0.9 that fixes the vulnerability. Consider restricting user privileges and auditing access to form data.
Other vulnerabilities in Advanced Contact form 7 DB
See all- CVE-2026-57669Medium
The Advanced Contact form 7 DB plugin version 2.0.9 and earlier contains a broken access control vulnerability exploitable by subscribers. A user with the subscriber role can gain unauthorized access to functions intended for administrators.
- CVE-2026-18594Medium
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.1.3. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with custom-level access or above to import forged CSV submission records into any Contact Form 7 form.
- CVE-2026-0814Medium
The Advanced Contact form 7 DB plugin for WordPress up to version 2.0.9 lacks proper capability checks in the 'vsz_cf7_export_to_excel' function. This allows authenticated attackers with Subscriber-level access or higher to export form submissions to an Excel file.
Original NVD description (English source)
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the 'acf7db' shortcode.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS