CVE-2026-0814
Unauthorized Data Export in Advanced Contact Form 7 DB Plugin
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpforms | advanced_contact_form_7_db | to 2.0.9 (inc) |
| advanced_contact_form_7_db | advanced_contact_form_7_db | to 2.0.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Advanced Contact form 7 DB plugin for WordPress has a vulnerability due to a missing capability check on the 'vsz_cf7_export_to_excel' function in all versions up to and including 2.0.9.
This flaw allows authenticated users with Subscriber-level access or higher to export form submissions to an Excel file without proper authorization.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access and export of form submission data by users who should not have such permissions.
Since even low-privileged authenticated users (Subscribers and above) can export sensitive data, this could result in data leakage or exposure of potentially sensitive information collected via the forms.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Subscriber-level access and above to export form submissions to an Excel file due to a missing capability check. This unauthorized access to potentially sensitive form submission data could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require strict controls on access to personal and sensitive information.
Specifically, unauthorized data export increases the risk of data breaches or improper handling of personal data, which can violate requirements for data confidentiality and access controls mandated by these standards.