EUVD-2026-41280
GHSA-hf25-m3ff-vv5r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Subscriber account required (PR:L); read-only database access yields no integrity or availability impact; network-accessible endpoint with no complexity beyond holding a valid account.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.
AnalysisAI
Broken access control in the Advanced Contact Form 7 DB WordPress plugin (versions <= 2.0.9) permits subscriber-level authenticated users to read all stored contact form submissions without authorization. The root cause is a missing capability check (CWE-862) on a data retrieval endpoint, exposing names, email addresses, phone numbers, and message content submitted by site visitors. No public exploit or CISA KEV listing exists at time of analysis, but low attack complexity and high confidentiality impact make this a meaningful risk on any WordPress site that permits open user registration.
Technical ContextAI
Advanced Contact Form 7 DB (CPE: cpe:2.3:a:vsourz_digital:advanced_contact_form_7_db:*:*:*:*:*:*:*:*) is a WordPress plugin by Vsourz Digital that extends the widely-used Contact Form 7 plugin by persisting form submissions to the WordPress database for later review. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints that retrieve stored submissions omit the required WordPress capability check - such as current_user_can('manage_options') or an equivalent role gate - before returning data. The WordPress subscriber role is the lowest default user role and carries no administrative capabilities. By failing to enforce this boundary, the plugin allows any authenticated user, regardless of role, to read the full submission dataset that should be restricted to administrators.
RemediationAI
The primary remediation is to update the Advanced Contact Form 7 DB plugin to the first version released after 2.0.9 once Vsourz Digital publishes a patched release; check the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/advanced-cf7-db/vulnerability/wordpress-advanced-contact-form-7-db-plugin-2-0-9-broken-access-control-vulnerability for the confirmed fixed version number, which is not independently verified in this dataset. If no patch is yet available, the most effective compensating control is to deactivate the plugin entirely until a fix is confirmed, which eliminates the exposure with no side effects other than losing the submission-logging feature. A secondary compensating control is to disable WordPress user registration (Settings > General, uncheck 'Anyone can register'), which prevents external actors from obtaining subscriber accounts and materially raises the exploitation barrier - note this impacts any site functionality that depends on self-registration. Do not rely solely on disabling registration if insider threat from existing subscriber accounts is a concern.
More in Advanced Contact Form 7 Db
View allCross-Site Request Forgery in Advanced Contact Form 7 DB plugin for WordPress (versions up to 2.0.9) allows unauthentica
Authorization bypass in the Advanced Contact Form 7 DB WordPress plugin (all versions through 2.1.3) allows authenticate
Export sensitive Contact Form 7 submissions without proper authorization in Advanced Contact form 7 DB plugin for WordPr
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today