CVE-2026-0811

Published: Apr 08, 2026 Last Modified: Apr 08, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: low

Description

AI Translation Available

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0001
Percentile
0,0th
Updated

EPSS Score Trend (Last 8 Days)

352

Cross-Site Request Forgery (CSRF)

Stable
Abstraction: Compound Structure: Composite
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability Non-Repudiation Access Control
Potential Impacts:
Gain Privileges Or Assume Identity Bypass Protection Mechanism Read Application Data Modify Application Data Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: Web Based, Web Server
Likelihood of Exploit: Medium
View CWE Details
https://plugins.trac.wordpress.org/browser/advanced-cf7-db/…
https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/cla…
https://plugins.trac.wordpress.org/changeset/3497481/advanc…
https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db
https://www.wordfence.com/threat-intel/vulnerabilities/id/8…
https://www.wordfence.com/threat-intel/vulnerabilities/id/88097744-d2f5-4ae5-aa…