Executive brief
The Advanced Contact form 7 DB plugin for WordPress, which stores and manages contact form submissions, is vulnerable to a security flaw that could allow attackers to delete form entries. By tricking a site administrator into clicking a malicious link, an attacker can remotely trigger the deletion of stored data without the administrator's knowledge. This could lead to the loss of important customer inquiries or business leads.
Technical details
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This vulnerability affects all versions up to and including 2.0.9. An unauthenticated attacker can exploit this by crafting a malicious request and using social engineering to trick a logged-in administrator into executing it (e.g., by clicking a link). Successful exploitation allows the attacker to delete form entries stored in the database. A patch appears to have been addressed in changeset 3497481.
Affected products
- vsourz1td Advanced Contact form 7 DB <= 2.0.9
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory