What CFDB7 does on your site
Database Addon for Contact Form 7, better known as CFDB7, fills the gap people mention most about Contact Form 7: it sends an email but keeps nothing. CFDB7, developed by Arshid and sold under the CipherCoin brand, saves every submission to the WordPress database. There is nothing to configure: once it is activated, every Contact Form 7 form on the site gets recorded.
Under the hood, the plugin hooks in just before the email goes out. The message is saved even if the email gets lost afterward, while submissions that Contact Form 7 blocks as spam are not kept. All the values of a submission are serialized into a single row of one table, wp_db7_forms (with your database prefix). Attached files are copied to wp-content/uploads/cfdb7_uploads, under a name prefixed with the time and a random string.
In the admin, the Contact Forms menu lists your forms with the number of submissions for each. One click opens the submission list: search, read or unread status, bulk delete, a detail view and an Export CSV button. Nothing loads on the front end. The plugin is free; CipherCoin sells paid add-ons separately (PDF or Excel export, automatic expiry, submission editing, external database).
Which sites CFDB7 is a good fit for
- Sites running Contact Form 7 that don’t want to lose another quote request when the notification email never arrives.
- Small teams that track requests in a spreadsheet: the CSV export works form by form, in one click.
- Agencies that want a record of submissions on a client site without switching form plugins.
It is not the right pick if you also want to keep submissions flagged as spam, or if you need WordPress’s personal data export and erasure tools: Flamingo, from the maker of Contact Form 7, handles both. It is not a request tracker either: no replies, no assignment, and no status beyond read and unread.
CFDB7 strengths and limitations
Strengths
- Zero configuration. Submissions are saved as soon as it is activated, for every existing and future form.
- Attachments are kept. Contact Form 7 deletes uploaded files after sending; CFDB7 keeps a copy you can open from the submission.
- Excel-friendly CSV. The file is UTF-8 with a byte order mark, so accents survive, and you pick the delimiter in the settings.
- Light and undemanding. No scripts on the front end, and it runs on WordPress 4.8 and PHP 7.0 or later.
Limitations
- Files reachable by URL. Attachments sit in a public folder under
uploads: anyone who gets a file’s address can open it. - No retention period. Submissions stay until you delete them; automatic expiry is a paid add-on.
- No WordPress privacy tools. The plugin does not hook into personal data export or erasure.
- Data left behind on removal. There is no uninstall routine: the table and the upload folder stay in place.
- Bare-bones, promotional screens. The interface is basic, and the form list shows a dismissible banner for the paid bundle.
The settings we recommend for CFDB7
CFDB7 has only one setting of its own, the CSV delimiter. Everything else comes down to roles, Contact Form 7 and your deletion routine.
| Setting | Recommended value | Why |
|---|---|---|
| Delimiter Contact Forms > Settings | Comma (,) by default; Semicolon (;) if colleagues open the CSV in a European-locale Excel | Excel in many European locales expects semicolons; with the wrong delimiter, everything lands in one column. |
Access to submissionscfdb7_access capability | Administrators only, or a dedicated role via User Role Editor | Submissions hold personal data; give the capability only to the people who handle requests. |
| Purging old submissions Contact Forms > form > Bulk Actions > Delete | Regular deletion of handled submissions, for example monthly | Set a retention period that fits privacy law; deleting also removes the submission’s attached files. |
| Anti-spam Contact > Integration (Contact Form 7) | Turnstile or Akismet enabled | Submissions rejected as spam are not saved, so the database stays clean and less exposed. |
| File field Contact > Contact Forms > Form tab | Restricted types and size, for example [file cv filetypes:pdf limit:2mb] | Every accepted file is copied permanently to uploads/cfdb7_uploads. |
| PHP execution Server configuration | Blocked in wp-content/uploads, which covers cfdb7_uploads | The folder only holds an index.php file that prevents directory listing; it blocks neither access to the files nor their execution. |
| Updates Plugins > Installed Plugins | Auto-updates enabled, version 1.4.2 or later | The fixed vulnerabilities could be triggered through submissions from anonymous visitors. |
- Send a test message, then check that it shows up under Contact Forms with the unread status.
- Export the CSV and open it in your spreadsheet app: accents and columns should display correctly.
- If a form accepts files, open an attachment link in a private window: it opens without logging in, which should shape which documents you ask for.
- Mention that submissions are stored, and for how long, in your privacy policy.
For retention periods and legal basis, see our article on GDPR and WordPress security.
CFDB7 vulnerabilities come in through anonymous submissions
Anyone who fills in a form writes to the CFDB7 database, and that is where its vulnerabilities come in. CVE-2025-6740, fixed in version 1.3.2, let a visitor without an account inject a script that ran when an administrator opened the submission, a stored XSS vulnerability. CVE-2024-3870, fixed in 1.2.7, exposed personal data contained in uploaded files. Going further back, CVE-2021-24144 (fixed in 1.2.5.6) allowed formulas to be injected into the CSV export.
The most recent one, CVE-2026-107652, affects every version up to 1.4.1: a crafted field in a submission made the plugin delete a file of the attacker’s choosing when an administrator deleted that submission. Version 1.4.2, released in October 2026, now checks that the deleted file really sits in cfdb7_uploads and refuses PHP files.
The step that matters is turning on auto-updates (see our guide to plugin auto-updates). WP Masquerade Pro removes the CFDB7 traces listed in its catalog (the next section details them), which makes the plugin harder for bots to spot without replacing the patch.
What WP Masquerade hides for Database Addon for Contact Form 7 (CFDB7)
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Database Addon for Contact Form 7 (CFDB7): without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
Nothing more
Still visible
No known trace
CFDB7 FAQ
Does CFDB7 work without Contact Form 7?
No. It only saves Contact Form 7 submissions, and its form list refuses to load if Contact Form 7 is not active.
Should I run CFDB7 and Flamingo together?
Nothing stops you, but every message would then be stored twice, doubling the personal data you have to protect and purge. Pick one.
Are submissions deleted when I delete the plugin?
No. The wp_db7_forms table and the cfdb7_uploads folder stay in place. Export whatever you need, then remove them yourself after taking a backup.
What do the paid add-ons include?
CipherCoin sells separate add-ons: PDF or Excel export, scheduled CSV export, automatic submission expiry, submission editing, CSV import and connection to another database. The 11-add-on bundle costs $99 for unlimited sites, with one year of updates and support.