CVE-2026-0811

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0811", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-09T15:21:38.033Z", "datePublished": "2026-04-08T17:25:52.629Z", "dateUpdated": "2026-04-08T19:10:25.260Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:52.629Z"}, "affected": [{"vendor": "vsourz1td", "product": "Advanced Contact form 7 DB", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88097744-d2f5-4ae5-aa71-0f4a0decd911?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/class-advanced-cf7-db-admin.php#L885"}, {"url": "https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "timeline": [{"time": "2026-04-08T05:13:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T19:00:58.912791Z", "id": "CVE-2026-0811", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:10:25.260Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0811", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T19:00:58.912791Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:07:59.596Z"}}], "cna": {"title": "Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "vsourz1td", "product": "Advanced Contact form 7 DB", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-08T05:13:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88097744-d2f5-4ae5-aa71-0f4a0decd911?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/class-advanced-cf7-db-admin.php#L885"}, {"url": "https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db"}], "descriptions": [{"lang": "en", "value": "The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:52.629Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0811", "state": "PUBLISHED", "dateUpdated": "2026-04-08T19:10:25.260Z", "dateReserved": "2026-01-09T15:21:38.033Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-08T17:25:52.629Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Advanced Contact form 7 DB", "vendor": "vsourz1td", "versions": [{"lessThanOrEqual": "2.0.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Advanced Contact form 7 DB para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 2.0.9, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la funci\u00f3n 'vsz_cf7_save_setting_callback'. Esto hace posible que atacantes no autenticados eliminen entradas de formulario a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-0811", "lastModified": "2026-07-25T11:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0811", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T19:00:58.912791Z", "version": "2.0.3"}}]}, "published": "2026-04-08T19:24:52.740", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/class-advanced-cf7-db-admin.php#L885"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88097744-d2f5-4ae5-aa71-0f4a0decd911?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.9]"}}], "enrichment": {"confidence": 96.0, "confidence_source": "matching", "scores": [{"score": 96.0, "source": "matching"}]}, "original": {"product": "Advanced Contact form 7 DB", "source": "cna", "vendor": "vsourz1td"}, "product": "advanced_contact_form_7_db", "vendor": "vsourz"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T19:54:58.285870+00:00", "value": {"mitigation_remediation": ["Update the Advanced Contact form 7 DB plugin to a version newer than 2.0.9 as soon as an official patch is released.", "If a fix is not yet available, limit administrator access to trusted users only and monitor logs for unexpected deletion actions.", "Consider disabling or removing the plugin entirely if it is not essential to site functionality."], "summary": {"action": "Immediate Patch", "impact": "Data Deletion via CSRF"}, "threat_synthesis": {"affected_systems": "The flaw affects all releases of the Advanced Contact form 7 DB WordPress plugin up to and including version 2.0.9. Site admins using these or earlier versions should confirm their plugin version and determine whether a newer, patched release is available.", "description_and_impact": "A Cross\u2011Site Request Forgery flaw in Advanced Contact form 7 DB arises from missing nonce validation in the \u2018vsz_cf7_save_setting_callback\u2019 method, allowing attackers to delete stored form entries when an administrator unknowingly clicks a crafted link. The vulnerability compromises the integrity of form submissions and can expose sensitive information, though it does not enable code execution or broader service disruption.", "risk_and_exploitability": "With a CVSS score of 5.4 and no EPSS data, the risk is moderate. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation. Attackers can exploit the weakness by performing unauthenticated CSRF that requires only an administrator to follow a malicious link, leading to loss of valuable form data."}}}}, "created": "2026-04-08T19:59:41.887039+00:00", "updated": "2026-04-09T08:18:37.967093+00:00", "vendors": ["vsourz", "vsourz$PRODUCT$advanced_contact_form_7_db", "wordpress", "wordpress$PRODUCT$wordpress"]}