{"id":"CVE-2026-18594","aliases":["EUVD-2026-75238","GHSA-3x6q-4q9w-c7h4"],"status":"published","title":"Advanced Contact form 7 DB \u003c= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'","description":"The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00366,"percentile":0.30802,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-09-10T03:40:41Z","modified":"2026-09-10T14:39:13Z","products":[{"vendor":"vsourz1td","product":"advanced contact form 7 db"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51abaca6-d882-40b8-86b1-e21835566e3b?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.1.3/admin/partials/import_cf7_entry.class.php#L255"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.1.3/admin/partials/import_cf7_entry.class.php#L51"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.1.3/admin/partials/import_cf7_csv.php#L56"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18594"},{"url":"https://github.com/advisories/GHSA-3x6q-4q9w-c7h4"}],"sources":{"cve":[{"id":"CVE-2026-18594","title":"Advanced Contact form 7 DB \u003c= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'","description":"The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.","status":"published","published":"2026-09-10T03:40:41.068Z","modified":"2026-09-10T13:36:45.915Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-75238","description":"The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.","status":"published","published":"2026-09-10T03:40:41Z","modified":"2026-09-10T13:36:45Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:25.275283Z"}],"ghsa":[{"id":"GHSA-3x6q-4q9w-c7h4","title":"The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all...","description":"The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.","status":"published","published":"2026-09-10T06:31:43Z","modified":"2026-09-10T06:31:54Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:11:40.819612Z"}],"nvd":[{"id":"CVE-2026-18594","description":"The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.","status":"published","published":"2026-09-10T04:17:48.613Z","modified":"2026-09-10T14:39:13.757Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:45.93749Z"}]}}