CVE-2025-58016

WordPress CF7 Submissions Plugin <= 0.26 - Broken Access Control Vulnerability

View on CVE.org
Published Sep 22, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through <= 0.26.

Analysis

AI-generated

Technical impact

The vulnerability is a missing authorization flaw in the Codexpert, Inc CF7 Submissions plugin. Incorrectly configured access control security levels allow an attacker to use plugin‑protected functions without proper authentication or privilege checks, potentially leading to unauthorized reading, creation, modification, or deletion of form submissions. The impact is primarily a grant of elevated privileges over sensitive plugin data and configuration.

Affected Systems

The plugin is distributed by Codexpert, Inc and is vulnerable in all releases up to and including version 0.26. Any WordPress site running CF7 Submissions 0.26 or earlier is affected; newer releases beyond this version are not listed as affected.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to access the site’s front‑end or an authenticated user session to reach the exposed endpoints; however, the exact prerequisites are not detailed in the advisory.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade CF7 Submissions to the latest version available (any release newer than 0.26 which addresses the access control issue).
  • Restrict access to the plugin’s administration and data endpoints by configuring appropriate WordPress user roles and capabilities, ensuring only trusted administrators can view or modify submissions.
  • Audit site logs for unusual access patterns to plugin URLs and block or rate‑limit suspicious IP addresses to reduce the risk of automated exploitation.

Generated by OpenCVE AI on April 30, 2026 at 01:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-30597 Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 Submissions: from n/a through 0.26.
History
Type Values Removed Values Added
Description Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through <= 0.27. Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through <= 0.26.
Title WordPress CF7 Submissions plugin <= 0.27 - Broken Access Control vulnerability WordPress CF7 Submissions Plugin <= 0.26 - Broken Access Control Vulnerability
Type Values Removed Values Added
Description Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through <= 0.26. Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through <= 0.27.
Title WordPress CF7 Submissions Plugin <= 0.26 - Broken Access Control Vulnerability WordPress CF7 Submissions plugin <= 0.27 - Broken Access Control vulnerability
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 Submissions: from n/a through 0.26. Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through <= 0.26.
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 Submissions: from n/a through 0.26.
Title WordPress CF7 Submissions Plugin <= 0.26 - Broken Access Control Vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
May 12, 2026, 1:00 AM
Reserved
Aug 22, 2025, 11:37 AM

View source JSON

Updated
Sep 23, 2025, 3:41 PM

JSON

Status
Deferred
Published
Sep 22, 2025, 7:16 PM
Modified
Oct 11, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 30, 2026, 1:15 AM

JSON