CVE-2026-57669
Deferred Deferred - Pending Action

Subscriber Broken Access Control in Advanced Contact Form 7 DB

Publication date: 2026-07-02

Last updated on: 2026-07-02

Assigner: Patchstack

Description
Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-02
Last Modified
2026-07-02
Generated
2026-07-02
AI Q&A
2026-07-02
EPSS Evaluated
N/A
NVD
CVE-2026-57669
EUVD
EUVD-2026-41280

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
advanced_contact_form_7_db advanced_contact_form_7_db to 2.0.9 (inc)
advanced_contact_form_7_db advanced_contact_form_7_db From 2.1.0 (inc)
advanced_contact_form_7 advanced_contact_form_7 to 2.0.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the WordPress Advanced Contact form 7 DB Plugin versions 2.0.9 and below is a Broken Access Control issue. This means that unprivileged users can perform actions that should require higher privileges because the plugin lacks proper authorization, authentication, or nonce token checks.

It is classified as a medium priority vulnerability with a CVSS score of 6.5 and falls under the OWASP Top 10 category A1: Broken Access Control.

Impact Analysis

This vulnerability allows attackers without proper privileges to perform higher-privileged actions on affected websites. This can lead to unauthorized access or manipulation of data.

Because it can be exploited in mass campaigns targeting thousands of websites, it poses a significant risk to website security and data integrity.

Immediate action is recommended, such as updating the plugin to version 2.1.0 or later or applying mitigation rules to block attacks.

Mitigation Strategies

Immediate action is advised to mitigate the Broken Access Control vulnerability in Advanced Contact form 7 DB Plugin versions 2.0.9 and below.

  • Update the plugin to version 2.1.0 or later.
  • Apply the mitigation rule provided by Patchstack to block attacks until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart