Advanced CF7 DB EUVD-2026-85112

Requires an authenticated WordPress account with Contributor-level privileges or above on a site running Advanced Contact Form 7 DB ≤2.0.9; the attacker then uses the plugin's 'acf7db' shortcode (which the plugin renders without an authorization check) to read all Contact Form 7 submission records. Limiting factors: exploitation is impossible without an existing low-privileged account (PR:L), so open-registration or multi-author sites are most exposed; impact is confidentiality-only (read access to submission data), with no integrity or availability effect and no code execution.

This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) is internally consistent with the description: network-reachable, low complexity, but requiring authenticated Contributor-level access (PR:L) and yielding confidentiality-only impact (C:H, I:N, A:N) - the ability to read all Contact Form 7 submission data via the 'acf7db' shortcode. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so exploitation status is: no public exploit identified at time of analysis. The chief risk-limiting factor is the PR:L requirement - an attacker must already hold a Contributor (or higher) account on the target WordPress site, which is common on multi-author blogs and membership sites but not the general case. The C:H rating is defensible because CF7 submissions frequently contain PII (names, emails, message bodies) from all site visitors, so a single low-privileged account can harvest the entire submission database. No signals conflict here; this is a plausible-real but not urgent authorization flaw rather than a high-CVSS-but-low-real-risk case, and the primary throttle on mass exploitation is the need for an existing authenticated foothold.

An attacker registers or compromises a Contributor-level account on a WordPress site running Advanced Contact Form 7 DB ≤2.0.9, then embeds the 'acf7db' shortcode in a draft or post they are authoring. Because the plugin fails to verify authorization for that shortcode, rendering it exposes all stored Contact Form 7 submission data - including other visitors' PII - to the low-privileged attacker. No public exploit code was identified, but exploitation is trivial once Contributor access is obtained.