Advanced Contact form 7 DB vulnerabilities

The Advanced Contact form 7 DB plugin version 2.0.9 and earlier contains a broken access control vulnerability exploitable by subscribers. A user with the subscriber role can gain unauthorized access to functions intended for administrators.

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the 'acf7db' shortcode.

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.1.3. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with custom-level access or above to import forged CSV submission records into any Contact Form 7 form.

The Advanced Contact form 7 DB plugin for WordPress up to version 2.0.9 lacks proper capability checks in the 'vsz_cf7_export_to_excel' function. This allows authenticated attackers with Subscriber-level access or higher to export form submissions to an Excel file.