# CVE-2026-0811: vsourz1td Advanced Contact form 7 DB CSRF in vsz_cf7_save_setting_callback

Source: https://junglewise.ai/threats/cve-2026-0811-vsourz1td-advanced-contact-form-7-db-csrf-in-vsz-cf7-save-setting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-0811 · Severity: medium · CVSS 5.4 · Published 2026-04-08

The Advanced Contact form 7 DB plugin for WordPress, which stores and manages contact form submissions, is vulnerable to a security flaw that could allow attackers to delete form entries. By tricking a site administrator into clicking a malicious link, an attacker can remotely trigger the deletion of stored data without the administrator's knowledge. This could lead to the loss of important customer inquiries or business leads.

## Quick answers

**Is CVE-2026-0811 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0811 being exploited in the wild.

**How severe is CVE-2026-0811?** Medium severity, with a CVSS score of 5.4, published 8 April 2026.

**Which products and versions are affected?** vsourz1td Advanced Contact form 7 DB <= 2.0.9.

**Is there a fix for CVE-2026-0811?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-0811 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-0811?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This vulnerability affects all versions up to and including 2.0.9. An unauthenticated attacker can exploit this by crafting a malicious request and using social engineering to trick a logged-in administrator into executing it (e.g., by clicking a link). Successful exploitation allows the attacker to delete form entries stored in the database. A patch appears to have been addressed in changeset 3497481.

## Affected products

- vsourz1td Advanced Contact form 7 DB <= 2.0.9

## Timeline

- 2026-04-08: disclosed
- 2026-04-08: advisory

## References

- [https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/class-advanced-cf7-db-admin.php](https://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/class-advanced-cf7-db-admin.php)
- [https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db](https://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/88097744-d2f5-4ae5-aa71-0f4a0decd911?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/88097744-d2f5-4ae5-aa71-0f4a0decd911?source=cve)