Description

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the 'acf7db' shortcode.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-23T07:16:45.883Z",
  "pubdate": "2026-09-23T07:16:45.883Z",
  "executiveSummary": "The Advanced Contact Form 7 DB plugin for WordPress, in all versions up to and including 2.0.9, contains a critical missing authorization vulnerability.\nThe flaw allows authenticated users with Contributor-level access or higher to bypass intended permission constraints and access sensitive form submission data.\nThis vulnerability is classified as a broken access control issue, where the application fails to perform adequate verification of user capabilities before granting access to protected data retrieval functions.\nThe impact is significant, as it leads to the unauthorized disclosure of potentially private user information submitted through Contact Form 7 integration.\nAttackers do not require elevated administrative privileges to exploit this; standard authenticated roles are sufficient to query the database and retrieve form records.\nThe risk is high for organizations relying on this plugin for data collection, as it exposes the entire submission history to internal malicious or compromised accounts.",
  "technicalDetails": "The vulnerability originates from a failure to implement robust capability checks within the 'acf7db' shortcode handling logic. In WordPress development, custom shortcodes that interface with database-stored sensitive data must explicitly verify user roles or specific 'capabilities' (e.g., 'manage_options') before executing data retrieval routines.\nIn the affected versions, the plugin registers the 'acf7db' shortcode without validating whether the current user has the necessary permissions to view the collected form data. By design, the shortcode executes a database query to fetch submission records, which is intended for administrators; however, the lack of conditional logic allows the query to execute successfully regardless of the user's role.\nThe attack flow proceeds as follows: 1) An attacker with at least Contributor-level privileges gains access to the WordPress post or page editor. 2) The attacker embeds the '[acf7db]' shortcode within a draft or published post. 3) Upon rendering the post, the WordPress shortcode API invokes the plugin's registered callback function. 4) The callback function fails to execute a current_user_can() check against the requested resource. 5) The plugin returns the full dataset of Contact Form 7 submissions to the client-side interface.\nThe scope of the impact includes any data captured by Contact Form 7, which may include Personally Identifiable Information (PII), contact details, and custom metadata. Since the plugin is a database-level collector, an attacker can effectively perform bulk data exfiltration by triggering the shortcode output via any area of the site where shortcodes are processed.\nThe vulnerability is present in all versions up to 2.0.9. It exposes the system to unauthorized data harvesting without leaving typical signs of web-based injection attacks, as the vulnerability is rooted in logic flaws rather than malformed input injection.\nNetwork exposure is defined by the WordPress installation itself; an attacker only needs the ability to trigger the rendering of the malicious shortcode, which is a standard feature for any authenticated WordPress user with the capability to edit content."
}