Description
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2026-04-08
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: Data Deletion via CSRF
Action: Immediate Patch
AI Analysis

Impact

A Cross‑Site Request Forgery flaw in Advanced Contact form 7 DB arises from missing nonce validation in the ‘vsz_cf7_save_setting_callback’ method, allowing attackers to delete stored form entries when an administrator unknowingly clicks a crafted link. The vulnerability compromises the integrity of form submissions and can expose sensitive information, though it does not enable code execution or broader service disruption.

Affected Systems

The flaw affects all releases of the Advanced Contact form 7 DB WordPress plugin up to and including version 2.0.9. Site admins using these or earlier versions should confirm their plugin version and determine whether a newer, patched release is available.

Risk and Exploitability

With a CVSS score of 5.4 and no EPSS data, the risk is moderate. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation. Attackers can exploit the weakness by performing unauthenticated CSRF that requires only an administrator to follow a malicious link, leading to loss of valuable form data.

Generated by OpenCVE AI on April 8, 2026 at 19:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Advanced Contact form 7 DB plugin to a version newer than 2.0.9 as soon as an official patch is released.
  • If a fix is not yet available, limit administrator access to trusted users only and monitor logs for unexpected deletion actions.
  • Consider disabling or removing the plugin entirely if it is not essential to site functionality.

Generated by OpenCVE AI on April 8, 2026 at 19:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Description The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Title Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T19:10:25.260Z

Reserved: 2026-01-09T15:21:38.033Z

Link: CVE-2026-0811

cve-icon Vulnrichment

Updated: 2026-04-08T19:07:59.596Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-08T19:24:52.740

Modified: 2026-04-08T21:26:13.410

Link: CVE-2026-0811

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-08T19:59:41Z

Weaknesses