What is the CVSS score of CVE-2026-0814?

CVE-2026-0814 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-0814

EUVD-2026-20530 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Wordfence

GHSA-74px-mhgq-xp77

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2026-20530

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 17:25 nvd

MEDIUM 4.3

DescriptionCVE.org

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in all versions up to, and including, 2.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export form submissions to excel file.

AnalysisAI

Export sensitive Contact Form 7 submissions without proper authorization in Advanced Contact form 7 DB plugin for WordPress versions up to 2.0.9 allows authenticated attackers with Subscriber-level or higher permissions to export form data to Excel files due to a missing capability check on the 'vsz_cf7_export_to_excel' function. While the CVSS score of 4.3 reflects low severity and no public exploit code exists, the vulnerability enables unauthorized data access on any WordPress site using this plugin, affecting site administrators managing contact form submissions that may contain sensitive user information.

Technical ContextAI

The Advanced Contact form 7 DB plugin extends Contact Form 7 functionality by storing submissions in a database. The vulnerability resides in the 'vsz_cf7_export_to_excel' function (located in admin/class-advanced-cf7-db-admin.php at line 1507) which generates Excel exports of form submissions. The root cause is a missing capability check (CWE-862: Missing Authorization) - the function validates that a user is authenticated (PR:L in CVSS vector) but fails to verify whether that user should have export privileges. This allows any authenticated user, including those with minimal Subscriber-level permissions, to perform an action restricted to administrators. The plugin is identified by CPE cpe:2.3:a:vsourz1td:advanced_contact_form_7_db:*:*:*:*:*:*:*:* and affects all versions through 2.0.9.

RemediationAI

Update the Advanced Contact form 7 DB plugin to version 2.1.0 or later. A fix was committed to the plugin repository (changeset 3497481 at https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db) which adds proper capability checks to the export function, ensuring only users with appropriate administrative permissions can export form submissions. Site administrators should navigate to WordPress Plugins dashboard, locate 'Advanced Contact form 7 DB', and click 'Update Now' to apply the patch automatically. If automatic updates are disabled, download the latest version from https://plugins.trac.wordpress.org/browser/advanced-cf7-db/ and upload manually via SFTP or the WordPress plugin upload interface. As an interim mitigation, restrict user registration or limit subscriber-level permissions if the plugin functionality does not require broad user access.