Cross-Site Request Forgery Vulnerability in Advanced Contact Form 7 DB Plugin for WordPress

CVE-2026-0811

What is CVE-2026-0811?

The Advanced Contact Form 7 DB plugin for WordPress contains a security flaw that allows unauthenticated attackers to exploit Cross-Site Request Forgery (CSRF). This issue arises from inadequate nonce validation in the 'vsz_cf7_save_setting_callback' function. Consequently, malicious actors can potentially delete form entries by deceiving site administrators into performing harmful actions, such as clicking on an infected link. It is crucial for users to be aware of this vulnerability and apply necessary updates to safeguard their sites.

References