CVE-2026-0811

Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB versions prior to 2.1.0

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the vsz cf7 save setting callback() function. A nonce is a unique token used to prevent the replay of requests. This flaw allows unauthenticated attackers to delete form entries by tricking a site administrator into clicking a malicious link.

Recommendations Update Advanced Contact form 7 DB to a version newer than 2.0.9.