The Advanced Contact Form 7 DB WordPress plugin has a missing authorization check for a shortcode that displays stored form entries. Because the plugin does not verify that the user’s role allows the action, anyone with Contributor or higher rights can insert the 'acf7db' shortcode into a post or page and cause the plugin to expose all submission data. This vulnerability is a classic access‑control flaw (CWE‑862) that grants read access to sensitive form data rather than enabling arbitrary code execution or denial of service.

WordPress sites running the Advanced Contact Form 7 DB plugin, version 2.0.9 or earlier (the plugin’s changelog indicates the issue is fixed in the 2.1.2 release). Sites that have the plugin installed and expose the 'acf7db' shortcode are susceptible.

The CVSS score of 6.5 places the flaw in the medium severity range. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread public exploitation has been reported. The attack vector requires the attacker to already have authenticated access with at least Contributor privileges; no external trigger is necessary. Once the attacker gains ability to insert or edit a page/post, they can trigger the shortcode and retrieve all stored submissions. Because the data may contain personally identifying information, the practical impact can be significant for privacy.