Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-0814 EUVD-2026-20530GHSA-74px-mhgq-xp77

Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export

Published Apr 8, 2026 · Updated Apr 8, 2026 · Assigned by Wordfence

Description

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in all versions up to, and including, 2.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export form submissions to excel file.

Affected products

VendorProductAffectedFixed
vsourz1td Advanced Contact form 7 DB ≤ 2.0.9 —

References