Advanced Contact Form 7 Db
Monthly
Authorization bypass in the Advanced Contact Form 7 DB WordPress plugin (all versions through 2.1.3) allows authenticated attackers holding custom-level or higher roles to inject forged CSV submission records into any Contact Form 7 form managed by the plugin. The flaw is rooted in missing authorization checks within the plugin's import functionality - source code references confirm the vulnerable logic at specific lines in import_cf7_entry.class.php and import_cf7_csv.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS rating of 4.3 (Medium) reflects the authenticated prerequisite and limited integrity-only impact.
Broken access control in the Advanced Contact Form 7 DB WordPress plugin (versions <= 2.0.9) permits subscriber-level authenticated users to read all stored contact form submissions without authorization. The root cause is a missing capability check (CWE-862) on a data retrieval endpoint, exposing names, email addresses, phone numbers, and message content submitted by site visitors. No public exploit or CISA KEV listing exists at time of analysis, but low attack complexity and high confidentiality impact make this a meaningful risk on any WordPress site that permits open user registration.
Cross-Site Request Forgery in Advanced Contact Form 7 DB plugin for WordPress (versions up to 2.0.9) allows unauthenticated attackers to delete form entries by exploiting missing nonce validation in the 'vsz_cf7_save_setting_callback' function. An attacker must trick a site administrator into clicking a malicious link, but no public exploit code or active exploitation has been confirmed at the time of analysis.
Export sensitive Contact Form 7 submissions without proper authorization in Advanced Contact form 7 DB plugin for WordPress versions up to 2.0.9 allows authenticated attackers with Subscriber-level or higher permissions to export form data to Excel files due to a missing capability check on the 'vsz_cf7_export_to_excel' function. While the CVSS score of 4.3 reflects low severity and no public exploit code exists, the vulnerability enables unauthorized data access on any WordPress site using this plugin, affecting site administrators managing contact form submissions that may contain sensitive user information.
Authorization bypass in the Advanced Contact Form 7 DB WordPress plugin (all versions through 2.1.3) allows authenticated attackers holding custom-level or higher roles to inject forged CSV submission records into any Contact Form 7 form managed by the plugin. The flaw is rooted in missing authorization checks within the plugin's import functionality - source code references confirm the vulnerable logic at specific lines in import_cf7_entry.class.php and import_cf7_csv.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS rating of 4.3 (Medium) reflects the authenticated prerequisite and limited integrity-only impact.
Broken access control in the Advanced Contact Form 7 DB WordPress plugin (versions <= 2.0.9) permits subscriber-level authenticated users to read all stored contact form submissions without authorization. The root cause is a missing capability check (CWE-862) on a data retrieval endpoint, exposing names, email addresses, phone numbers, and message content submitted by site visitors. No public exploit or CISA KEV listing exists at time of analysis, but low attack complexity and high confidentiality impact make this a meaningful risk on any WordPress site that permits open user registration.
Cross-Site Request Forgery in Advanced Contact Form 7 DB plugin for WordPress (versions up to 2.0.9) allows unauthenticated attackers to delete form entries by exploiting missing nonce validation in the 'vsz_cf7_save_setting_callback' function. An attacker must trick a site administrator into clicking a malicious link, but no public exploit code or active exploitation has been confirmed at the time of analysis.
Export sensitive Contact Form 7 submissions without proper authorization in Advanced Contact form 7 DB plugin for WordPress versions up to 2.0.9 allows authenticated attackers with Subscriber-level or higher permissions to export form data to Excel files due to a missing capability check on the 'vsz_cf7_export_to_excel' function. While the CVSS score of 4.3 reflects low severity and no public exploit code exists, the vulnerability enables unauthorized data access on any WordPress site using this plugin, affecting site administrators managing contact form submissions that may contain sensitive user information.