A missing authorization vulnerability in the Advanced Contact form 7 DB plugin allows authenticated attackers to access unauthorized data, posing a significant risk to user privacy.

This is a missing authorization flaw (CWE-862) triggered via the acf7db shortcode. The vulnerability allows an authenticated attacker with Contributor-level access or higher to bypass permission checks and read unauthorized contact form submission entries.

The exploitation of this vulnerability results in the unauthorized disclosure of sensitive information contained within contact form submissions. Given the CVSS score of 6.5, this medium-severity flaw represents a notable risk to data confidentiality, potentially leading to regulatory compliance issues and loss of user trust if personal data is exposed.

Immediate Action: Update the Advanced Contact form 7 DB plugin to version 2.1.2 or later immediately to resolve the authorization check deficiency.

Proactive Monitoring: Review web server and WordPress access logs for unusual requests targeting the acf7db shortcode, particularly from accounts with lower-level privileges such as Contributors.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict access to sensitive plugin endpoints or disable the affected shortcode until the update is applied.

Public Exploit Available: Unknown

The vulnerability is well-documented and a vendor-supplied patch is available in version 2.1.2. Administrators should prioritize updating this plugin to eliminate the authorization bypass risk and prevent unauthorized access to sensitive form data. Organizations failing to update remain exposed to potential data exfiltration by malicious or compromised internal users.