Authorization Bypass in Advanced Contact Form 7 DB Plugin from WordPress

CVE-2026-18594

What is CVE-2026-18594?

The Advanced Contact Form 7 DB plugin for WordPress is susceptible to an authorization bypass flaw that affects all versions up to and including 2.1.3. The vulnerability allows authenticated users, possessing custom-level access or higher, to import malicious CSV submission records into any Contact Form 7 form integrated with this plugin. This undermines the security measures associated with user actions and could lead to unauthorized access or manipulation of form data.

References