EUVD-2026-75238
GHSA-3x6q-4q9w-c7h4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-exploitable via WordPress admin with low-privilege authenticated account; impact limited to injecting forged records with no confidentiality or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.
AnalysisAI
Authorization bypass in the Advanced Contact Form 7 DB WordPress plugin (all versions through 2.1.3) allows authenticated attackers holding custom-level or higher roles to inject forged CSV submission records into any Contact Form 7 form managed by the plugin. The flaw is rooted in missing authorization checks within the plugin's import functionality - source code references confirm the vulnerable logic at specific lines in import_cf7_entry.class.php and import_cf7_csv.php. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at least 'custom-level' access - meaning any non-standard role that grants access to the WordPress admin area, above subscriber/contributor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N correctly captures a network-exploitable, low-complexity flaw requiring only a low-privilege authenticated WordPress account, with impact confined to data integrity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Advanced Contact Form 7 DB plugin to a version beyond 2.1.3 via the WordPress plugin repository or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/51abaca6-d882-40b8-86b1-e21835566e3b. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Advanced Contact Form 7 Db
View allBroken access control in the Advanced Contact Form 7 DB WordPress plugin (versions <= 2.0.9) permits subscriber-level au
Cross-Site Request Forgery in Advanced Contact Form 7 DB plugin for WordPress (versions up to 2.0.9) allows unauthentica
Export sensitive Contact Form 7 submissions without proper authorization in Advanced Contact form 7 DB plugin for WordPr
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today