The Advanced Contact form 7 DB plugin contains a missing capability check in the export function. As a result, any authenticated user with a Subscriber role or higher can trigger the export feature and retrieve form submissions as an Excel file. This flaw is a direct unauthorized read of sensitive data, constituting a data exposure vulnerability identified as CWE-862. The CVSS score of 4.3 reflects a moderate impact but indicates that once accessed, confidential information may be obtained by an attacker.

WordPress sites that have installed the Advanced Contact form 7 DB plugin from the vsourz1td vendor. All releases up to and including version 2.0.9 are affected. Users should verify whether their installations are running any version 2.0.9 or earlier.

The flaw is exploitable by any user who has logged in with a Subscriber or higher role on the site; no additional system compromise or privilege escalation is required. Exploitation is straightforward through the plugin’s export feature, but the attacker must already possess valid credentials. The CVSS score indicates a moderate risk, and the EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalog.