CVE-2026-18594

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.

• CWE-862

• https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.1.3/admin/partials/import_cf7_csv.php#L56
• https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.1.3/admin/partials/import_cf7_entry.class.php#L255
• https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.1.3/admin/partials/import_cf7_entry.class.php#L51
• https://www.wordfence.com/threat-intel/vulnerabilities/id/51abaca6-d882-40b8-86b1-e21835566e3b?source=cve

Published

Sep 10, 2026

Last Modified

Sep 10, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18588A vulnerability has been found in Wavlink WL-NU516U1 708c073…9.8
• CVE-2026-18589A vulnerability was found in Wavlink WL-NU516U1 708c073-mt76…9.8
• CVE-2026-18590A vulnerability was determined in Wavlink WL-NU516U1 708c073…6.3
• CVE-2026-18591A vulnerability was identified in Meesho Online Shopping App…2.1
• CVE-2026-18592A security flaw has been discovered in osCommerce 4.14.63493…4.7
• CVE-2026-18593A weakness has been identified in vxcontrol PentAGI up to 2.…5.6
• CVE-2026-18595The WP-Lister Lite for eBay plugin for WordPress is vulnerab…7.2
• CVE-2026-18597The PDF creation feature of Foxit PDF Services API supports …8.5
• CVE-2026-18598A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.…8.8
• CVE-2026-18599A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The …8
• CVE-2026-1860The Kali Forms plugin for WordPress is vulnerable to Insecur…4.3
• CVE-2026-18600A vulnerability has been found in GL.iNet GL-MT3000 up to 4.…8.8