CVE-2026-18594
Deferred Deferred - Pending Action

Authorization Bypass in Advanced Contact Form 7 DB WordPress Plugin

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: Wordfence

Description
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-30
AI Q&A
2026-09-10
EPSS Evaluated
2026-09-29
NVD
CVE-2026-18594
EUVD
EUVD-2026-75238

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpforms advanced_contact_form_7_db to 2.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Advanced Contact Form 7 DB plugin for WordPress has an authorization bypass vulnerability in versions up to 2.1.3. It fails to verify user authorization properly, allowing authenticated attackers with custom-level access or higher to import fake CSV submission records into any Contact Form 7 form managed by the plugin.

Detection Guidance

This vulnerability allows authenticated attackers to import forged CSV submission records into Contact Form 7 forms. To detect it, check WordPress logs for unusual CSV import activity or unauthorized form submissions. Review plugin versions and ensure Advanced Contact Form 7 DB is updated beyond 2.1.3.

Impact Analysis

This vulnerability allows attackers to manipulate form submissions, potentially inserting false data into your WordPress forms. This could lead to data integrity issues, misleading records, or unauthorized modifications to form content.

Compliance Impact

This vulnerability could compromise data integrity and confidentiality, which are critical for GDPR and HIPAA compliance. Unauthorized data manipulation may lead to violations of record-keeping and data protection requirements.

Mitigation Strategies

Update the Advanced Contact Form 7 DB plugin to the latest version beyond 2.1.3 to fix the authorization bypass issue. If immediate update is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18594. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart