CVE-2026-6709

Name of the Vulnerable Software and Affected Versions Coinbase Commerce for Contact Form 7 versions prior to 1.1.3

Description The plugin contains a missing authorization flaw caused by a lack of capability checks and nonce verification (a unique token used to prevent cross-site request forgery) within the save settings() function, which is registered on the admin post cccf7 save settings hook. This allows authenticated users with Subscriber-level access or higher to overwrite the cccf7 api key variable via a crafted POST request to the '/wp-admin/admin-post' endpoint.

Recommendations Update the plugin to a version later than 1.1.2.