Advisories · nist.gov

CVE-2026-18594

nist.gov

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.

More from nist.gov

CVE-2026-0306nist.govCVE-2026-0307nist.govCVE-2026-0308nist.govCVE-2026-0305nist.govCVE-2026-49363nist.govCVE-2026-49364nist.gov

Also in Advisories

  1. Friday Squid Blogging: Rotting Squid on a Beached California BoatBruce Schneierschneier.com
  2. My Talk at DEF CONBruce Schneierschneier.com
  3. Cliff Stoll’s DEF CON TalkBruce Schneierschneier.com
  4. AIs Compress Exploit TimelineBruce Schneierschneier.com
  5. Revised Medical Criteria for Evaluating Cardiovascular Disordersfederalregister.gov
  6. Continuation of the National Emergency With Respect to Persons Who Commit, Threaten To Commit, or Support Terrorismfederalregister.gov