CVE-2026-6831
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 23, 2026
Vendor
unknown
Description
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the 'acf7db' shortcode.