Advanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File Deletion
Priority LOW 36CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass, Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863 and CWE-352.
Summary
The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.
Why it matters now
EPSS 0.0077 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Advanced Contact form 7 DB (Unknown): 1.8.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Advanced Contact form 7 DB | 1.8.7 to before 1.8.7 | 1.8.7 | Patch available | CNA |
- Advanced Contact form 7 DB VendorUnknown Affected 1.8.7 to before 1.8.7 Fixed in 1.8.7 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vsourz:advanced_cf7_db:*:*:*:*:*:wordpress:*:* | before 1.8.7 | Vulnerable | Vsourz Digital |
- cpe:2.3:a:vsourz:advanced_cf7_db:*:*:*:*:*:wordpress:*:* Versions before 1.8.7 Vulnerable ·Vsourz Digital
Remediation
- Fix · CNA Advanced Contact form 7 DB (Unknown) Fixed in 1.8.7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24905
- 2026-10-03 Alias added: GHSA-mjq7-mv4f-72x7
References
More Vsourz Digital Advanced Cf7 Db vulnerabilities
- TI-2022-22289 Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1MEDIUM 6.1
- TI-2019-10203 A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through… CVSS 3.1CRITICAL 9.8
- TI-2022-11879 Cross-site scripting in Vsourz Digital Advanced Contact form 7 DB CVSS 3.1MEDIUM 6.1
Sources
- CVE-2021-24905 · CVE Program
- CVE-2021-24905 · NVD
- FIRST EPSS
- GHSA-mjq7-mv4f-72x7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences