CVE-2026-0811: falha de média gravidade em vsourz1td Advanced Contact form 7 DB
Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.1%
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Produtos afetados
vsourz1td · Advanced Contact form 7 DBCVEs relacionadas — vsourz1td Advanced Contact form 7 DB
No mesmo produto, das mais perigosas para as menos.
CVE-2024-4319MEDIUMAdvanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information DisclosureEPSS 0.5%CVE-2024-3723MEDIUMAdvanced Contact form 7 DB <= 2.0.2 - Sensitive Information ExposureEPSS 0.4%CVE-2026-18594MEDIUMAdvanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'EPSS 0.4%CVE-2026-6831MEDIUMAdvanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' ShortcodeEPSS 0.4%CVE-2026-0814MEDIUMAdvanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel ExportEPSS 0.3%