This vulnerability (CVE-2026-57669) affects Advanced Contact form 7 DB plugin versions up to 2.0.9 by allowing subscriber-level users to bypass authorization controls (CWE-862). The weakness permits unauthorized access to data that should be restricted, impacting confidentiality. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and requires only low privileges, but no user interaction. There is no known exploit in the wild and no vendor-provided patch or mitigation at this time.

The vulnerability allows unauthorized access to sensitive data by bypassing authorization checks, impacting confidentiality. There is no reported impact on integrity or availability. Attackers with subscriber-level privileges can exploit this remotely without user interaction, potentially exposing sensitive information stored or managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting subscriber privileges or limiting plugin usage to trusted users if feasible.