# CVE-2026-0814: vsourz1td Advanced Contact form 7 DB missing authorization

Source: https://junglewise.ai/threats/cve-2026-0814-vsourz1td-advanced-contact-form-7-db-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-0814 · Severity: medium · CVSS 4.3 · Published 2026-04-08

The Advanced Contact form 7 DB plugin for WordPress, which stores and manages form submissions, contains a security flaw that allows unauthorized users to access sensitive data. An attacker with a basic user account on the website can export all contact form submissions into an Excel file. This could lead to the exposure of private customer information and communication history.

## Quick answers

**Is CVE-2026-0814 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0814 being exploited in the wild.

**How severe is CVE-2026-0814?** Medium severity, with a CVSS score of 4.3, published 8 April 2026.

**Which products and versions are affected?** vsourz1td Advanced Contact form 7 DB up to, and including, 2.0.9.

**Is there a fix for CVE-2026-0814?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-0814 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-0814?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as a Missing Authorization (CWE-862) issue within the 'vsz_cf7_export_to_excel' function of the Advanced Contact form 7 DB plugin. Because the plugin fails to perform a capability check (such as current_user_can()) on this specific function, any authenticated user, including those with the lowest 'Subscriber' permissions, can trigger the export process. An attacker can exploit this by sending a crafted request to the server to download an Excel file containing all stored form submissions. The issue affects all versions of the plugin up to and including 2.0.9. A patch has been identified in subsequent changesets.

## Affected products

- vsourz1td Advanced Contact form 7 DB up to, and including, 2.0.9

## Timeline

- 2026-04-08: disclosed
- 2026-04-08: advisory

## References

- [https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/class-advanced-cf7-db-admin.php](https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/class-advanced-cf7-db-admin.php)
- [https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db](https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3de1a4-a534-475b-9138-2337755b0288?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3de1a4-a534-475b-9138-2337755b0288?source=cve)