CVE-2026-0814

Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB plugin for WordPress versions up to and including 2.0.9

Description The Advanced Contact form 7 DB plugin for WordPress has a flaw that allows unauthorized data access. This is due to a missing capability check on the vsz cf7 export to excel function. Attackers with Subscriber-level access or higher can export form submissions to an excel file.

Recommendations Update to a version later than 2.0.9.