# Multi Step for Contact Form <= 2.9.1 - Unauthenticated Insecure Direct Object Reference to Form Submission Modification and Deletion via '_cf7mls_db_form_data_id' Parameter

- **ID:** WPSEC-2026-3029
- **Plugin:** Multi Step for Contact Form 7 (`cf7-multi-step`), https://wordpress.org/plugins/cf7-multi-step/
- **Affected versions:** all versions before 2.9.2
- **Fixed in:** 2.9.2 (Update to 2.9.2 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cf7-multi-step
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3029/

## Description

The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Insecure Direct Object Reference via the '_cf7mls_db_form_data_id' parameter of the 'cf7mls/v1/cf7mls_validation' REST route in all versions up to, and including, 2.9.1. This is due to missing validation that the submitted data ID belongs to the current form submission when step data is saved to the Database for Contact Form 7 (cf7-database) integration, and due to the plugin storing any posted field, including '_cf7mls_db_form_data_id' itself, which is later used to choose which submission to delete. This makes it possible for unauthenticated attackers to add arbitrary field entries to stored form submissions belonging to other users, and to cause other stored submissions to be deleted. Exploitation requires the Database for Contact Form 7 plugin to be active and the 'save every step' option to be enabled for a form.

## References

- https://wpsec.com/vuln/WPSEC-2026-3029/
- https://plugins.svn.wordpress.org/cf7-multi-step/tags/2.9.2/
- https://wordpress.org/plugins/cf7-multi-step/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3029/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.