Advanced Contact Form 7 DB Missing Authorization Vulnerability in WordPress

A vulnerability exists in the Advanced Contact Form 7 DB plugin for WordPress, specifically in versions up to and including 2.0.9. The issue arises from a lack of proper capability checks in the 'vsz_cf7_export_to_excel' function, allowing authenticated attackers with Subscriber-level access or higher to export form submissions as Excel files. This unauthorized data access could lead to potential privacy breaches by exposing sensitive information contained in the form submissions.

Impact

Exploitation of this vulnerability allows for unauthorized export of form submission data to Excel, potentially exposing sensitive information.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can navigate to the Contact Form DB admin interface. From there, they can select a form and use the export feature to download the submissions as an Excel file. The absence of proper authorization checks allows this action to be performed without the necessary permissions.

Remediation

Users are advised to update the Advanced Contact Form 7 DB plugin to version 2.1.0 or later, where this vulnerability has been patched.