CVE-2026-0811: Advanced Contact Form 7 DB CSRF Vulnerability

CVE-2026-0811 Overview

CVE-2026-0811 is a Cross-Site Request Forgery (CSRF) vulnerability in the Advanced Contact form 7 DB plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.9. The vulnerability stems from missing or incorrect nonce validation on the vsz_cf7_save_setting_callback function. Unauthenticated attackers can delete form entries by tricking a site administrator into clicking a crafted link. The issue is tracked as [CWE-352].

Critical Impact

Successful exploitation allows an unauthenticated attacker to delete contact form entries stored by the plugin, resulting in loss of submitted form data when an administrator interacts with an attacker-controlled link.

Affected Products

• Advanced Contact form 7 DB plugin for WordPress, versions through 2.0.9
• WordPress sites running the affected plugin with an authenticated administrator session
• Plugin function vsz_cf7_save_setting_callback in class-advanced-cf7-db-admin.php

Discovery Timeline

• 2026-04-08 - CVE-2026-0811 published to NVD
• 2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-0811

Vulnerability Analysis

The Advanced Contact form 7 DB plugin exposes administrative actions through the vsz_cf7_save_setting_callback handler. This handler processes settings-related requests, including form entry deletion, but does not properly validate a WordPress nonce before executing the action. WordPress nonces are the platform's primary mechanism for protecting state-changing requests against forged cross-origin submissions. Without a valid nonce check, the handler accepts any request that carries a logged-in administrator's session cookie, regardless of where the request originated. Attackers chain this gap with social engineering to coerce an administrator into issuing the request unknowingly. The result is unauthorized deletion of stored form submissions and integrity loss for collected contact data.

Root Cause

The root cause is missing or incorrect nonce validation, classified under [CWE-352] Cross-Site Request Forgery. The vsz_cf7_save_setting_callback function does not call check_admin_referer() or wp_verify_nonce() against a request-bound token before processing input. Because WordPress browser sessions automatically attach authentication cookies, the absence of a verifiable, request-specific token leaves the endpoint indistinguishable from a legitimate administrator action.

Attack Vector

The attack requires network access and user interaction. An attacker hosts a page or embeds a link containing a crafted request targeting the vulnerable endpoint on the victim site. When an authenticated WordPress administrator visits the attacker's content while logged in, the browser submits the request with the administrator's cookies. The plugin executes the deletion without verifying request origin, removing form entries from the database. No prior privileges on the target site are required by the attacker. See the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-0811

Indicators of Compromise

• Unexpected deletion of records from the Advanced Contact form 7 DB plugin tables without a corresponding administrator-initiated action in audit logs
• HTTP requests to admin-ajax.php or admin endpoints invoking vsz_cf7_save_setting_callback with a Referer header pointing to an external domain
• Administrator account activity correlated with visits to untrusted external links shortly before form entry loss

Detection Strategies

• Inspect web server access logs for POST or GET requests targeting plugin admin endpoints that lack expected nonce parameters such as _wpnonce
• Compare snapshots of form entry counts over time and alert on unexplained drops
• Review WordPress audit plugins or database triggers for deletions occurring outside scheduled administrative workflows

Monitoring Recommendations

• Enable verbose logging on the WordPress admin interface and forward logs to a centralized analytics platform for correlation
• Monitor administrator browsing sessions for navigation to unknown external domains immediately preceding plugin state changes
• Alert on HTTP requests to plugin admin endpoints originating from cross-origin referrers

How to Mitigate CVE-2026-0811

Immediate Actions Required

• Update the Advanced Contact form 7 DB plugin to a version newer than 2.0.9 that includes the fix from changeset 3497481
• Back up the WordPress database before applying updates to preserve recoverable form entry data
• Require administrators to log out of WordPress sessions before browsing untrusted sites until the patch is verified in place

Patch Information

The vendor addressed the issue in the plugin update referenced by WordPress Plugin Changeset 3497481. The fix introduces proper nonce validation on the vsz_cf7_save_setting_callback handler so that state-changing requests must include a valid WordPress nonce tied to the administrator session.

Workarounds

• Restrict access to the WordPress admin interface using IP allowlists or VPN-only access
• Deploy a web application firewall (WAF) rule that blocks requests to plugin admin endpoints lacking a valid _wpnonce parameter and a same-origin Referer
• Temporarily deactivate the Advanced Contact form 7 DB plugin until the patched version is installed

# Example WP-CLI commands to inventory and update the affected plugin
wp plugin list --name=advanced-cf7-db --fields=name,status,version
wp plugin update advanced-cf7-db
wp plugin get advanced-cf7-db --field=version