PT-2026-31389 · Vsourz1Td · Advanced Contact Form 7 Db

Kai Aizen · CVE-2026-0811 · Published 2026-04-08 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB versions prior to 2.1.0

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the vsz cf7 save setting callback() function. A nonce is a unique token used to prevent the replay of requests. This flaw allows unauthenticated attackers to delete form entries by tricking a site administrator into clicking a malicious link.

Recommendations Update Advanced Contact form 7 DB to a version newer than 2.0.9.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-0811

Affected Products

Advanced Contact Form 7 Db

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-0811 · Security Note
• https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/class-advanced-cf7-db-admin.php#L885 · Note
• https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/88097744-d2f5-4ae5-aa71-0f4a0decd911?source=cve · Note