CVE-2026-0811: 
WordPress vulnerability analysis and mitigation

CVE-2026-0811 is a Cross-Site Request Forgery (CSRF) vulnerability in the Advanced Contact form 7 DB plugin for WordPress, affecting all versions up to and including 2.0.9. The flaw allows unauthenticated attackers to delete form entries by tricking a site administrator into clicking a malicious link. It was published on April 8, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is missing or incorrect nonce validation on the vsz_cf7_save_setting_callback function within the plugin's admin class (class-advanced-cf7-db-admin.php, line 885), classified as CWE-352 (Cross-Site Request Forgery). Because the function does not verify that the incoming request originates from a legitimate, authenticated session, an attacker can craft a forged HTTP request that the administrator's browser will send with valid session credentials. Exploitation requires social engineering — the attacker must lure a logged-in administrator into clicking a crafted link or visiting a malicious page that silently submits the forged request (GitHub Advisory, Wordfence).

Successful exploitation results in unauthorized deletion of contact form entries stored by the plugin, causing data loss and reduced availability of form submission records. There is no confidentiality impact, as the attacker cannot read data — only delete it. The integrity and availability of form data are the primary concerns, and the attack could be used in targeted campaigns to erase evidence of specific form submissions or disrupt business operations relying on contact form data (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.012–0.014%, placing it in the low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (an administrator clicking a malicious link), limiting its practical reach to phishing or social engineering scenarios (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites using the Advanced Contact form 7 DB plugin version 2.0.9 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft forged request: Construct a malicious HTML page or link that submits a POST request to the target WordPress site's admin endpoint invoking vsz_cf7_save_setting_callback with parameters to trigger form entry deletion.
3. Social engineering: Deliver the malicious link to a site administrator via phishing email, forum post, or other communication channel, enticing them to click it while logged into their WordPress admin session.
4. CSRF execution: When the administrator clicks the link, their browser automatically sends the forged request with their valid session cookies, bypassing authentication checks due to the missing nonce validation.
5. Data deletion achieved: The vsz_cf7_save_setting_callback function processes the request and deletes the targeted form entries without verifying the request's legitimacy (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to admin-ajax.php or admin endpoints invoking vsz_cf7_save_setting_callback from unusual referrer URLs or external domains.
• Application: Sudden unexplained deletion of contact form entries in the Advanced Contact form 7 DB plugin dashboard without corresponding administrator action.
• Logs: WordPress audit logs (if enabled via a plugin such as WP Activity Log) recording form entry deletions attributed to an administrator account at unusual times or from unexpected IP addresses.

Update the Advanced Contact form 7 DB plugin to the version released after 2.0.9, which includes the fix applied in changeset 3497481. The patch adds proper nonce validation to the vsz_cf7_save_setting_callback function, preventing forged requests from being processed. As an interim measure, administrators should avoid clicking links from untrusted sources while logged into WordPress, and consider deploying a Web Application Firewall (WAF) capable of detecting CSRF patterns. Access to the plugin's admin functionality should be restricted to trusted administrators only (GitHub Advisory, Wordfence).