PT-2026-31390 · WordPress · Advanced Contact Form 7 Db+1

Kai Aizen · Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-0814

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB plugin for WordPress versions up to and including 2.0.9

Description The Advanced Contact form 7 DB plugin for WordPress has a flaw that allows unauthorized data access. This is due to a missing capability check on the vsz cf7 export to excel function. Attackers with Subscriber-level access or higher can export form submissions to an excel file.

Recommendations Update to a version later than 2.0.9.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-0814

Affected Products

Advanced Contact Form 7 Db

Wordpress

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-0814 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5e3de1a4-a534-475b-9138-2337755b0288?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db · Note
• https://twitter.com/CVEnew/status/2041975615230759062 · Twitter Post
• https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/class-advanced-cf7-db-admin.php#L1507 · Note