Advanced Contact form 7 DB

Advanced Contact form 7 DB has 13 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; 11 are fixed and 2 remain unpatched as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 3 high. 2026 was the busiest year with 5 disclosures.

The most common weakness is Missing Authorization, behind 5 of the records (38%). Other recurring categories include SQL Injection, Cross-Site Request Forgery (CSRF).

11 of the records (85%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2024.

10 independent researchers contributed these findings, most of them (2) reported by Kai Aizen.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage85%

Open

Fixed

Get automatic notifications for all Advanced Contact form 7 DB vulnerabilities before they are exploited.

Most severe open issueCVSS 7.5CVE-2024-45293

PHPSpreadsheet Library < 2.3.0 - XXE Injection

Read the full analysis

Vulnerability Records

13 records


2026-09-22 17:36	Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode Advanced Contact form 7 DB <= 2.1.1	`CVE-2026-6831`	6.5 Medium	Quốc Huy (jtwings)	Yes
2026-09-09 15:19	Advanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id' Advanced Contact form 7 DB <= 2.1.3	`CVE-2026-18594`	4.3 Medium	Jiang CY	No
2026-06-30 00:00	Advanced Contact form 7 DB <= 2.0.9 - Missing Authorization Advanced Contact form 7 DB <= 2.0.9	`CVE-2026-57669`	4.3 Medium	timomangcut	Yes
2026-04-08 05:13	Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion Advanced Contact form 7 DB <= 2.0.9	`CVE-2026-0811`	5.4 Medium	Kai Aizen	Yes
2026-04-08 05:13	Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export Advanced Contact form 7 DB <= 2.0.9	`CVE-2026-0814`	4.3 Medium	Kai Aizen	Yes
2025-04-07 00:00	Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel) Advanced Contact form 7 DB <= 2.0.8	`CVE-2014-2054`	3.7 Low	Anonymous	Yes
2024-10-07 00:00	PHPSpreadsheet Library < 2.3.0 - XXE Injection Advanced Contact form 7 DB <= 2.0.5	`CVE-2024-45293`	7.5 High	Anonymous	No
2024-06-10 17:32	Advanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure Advanced Contact form 7 DB <= 2.0.2	`CVE-2024-4319`	5.3 Medium	1337_Wannabe	Yes
2024-06-10 17:31	Advanced Contact form 7 DB <= 2.0.2 - Sensitive Information Exposure Advanced Contact form 7 DB <= 2.0.2	`CVE-2024-3723`	5.3 Medium	Tim Coen	Yes
2022-04-21 14:19	Advanced Contact form 7 DB <= 1.8.7 - Stored Cross-Site Scripting Advanced Contact form 7 DB <= 1.8.7	`CVE-2022-29408`	6.1 Medium	R3N0	Yes

Showing 1–10 of 13 reports