What is the CVSS score of CVE-2026-0811?

CVE-2026-0811 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-0811

EUVD-2026-20529 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-08 Wordfence

GHSA-26pj-mrh2-39gw

WordPress CSRF

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2026-20529

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 17:25 nvd

MEDIUM 5.4

DescriptionCVE.org

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in Advanced Contact Form 7 DB plugin for WordPress (versions up to 2.0.9) allows unauthenticated attackers to delete form entries by exploiting missing nonce validation in the 'vsz_cf7_save_setting_callback' function. An attacker must trick a site administrator into clicking a malicious link, but no public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability stems from improper implementation of WordPress security mechanisms, specifically the absence or incorrect validation of nonce tokens (CWE-352: Cross-Site Request Forgery) on the 'vsz_cf7_save_setting_callback' administrative function. WordPress nonces are cryptographic tokens designed to validate that form submissions originate from legitimate, authenticated sessions and prevent CSRF attacks. The Advanced Contact Form 7 DB plugin, which extends Contact Form 7 functionality by storing form submissions in a database, fails to implement this protection on a callback function that handles sensitive administrative operations such as deleting form entries. The plugin is distributed via the official WordPress plugin repository and is identified by CPE cpe:2.3:a:vsourz1td:advanced_contact_form_7_db:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade the Advanced Contact Form 7 DB plugin to version 2.0.10 or later, which addresses the nonce validation vulnerability by implementing proper CSRF token checks on the 'vsz_cf7_save_setting_callback' function. The patch was introduced in changeset 3497481 as referenced in the official WordPress plugin repository. Site administrators should immediately update the plugin via the WordPress admin dashboard (Plugins > Installed Plugins > Advanced Contact Form 7 DB > Update). Until patching is possible, reduce risk by limiting administrative account access to trusted users and educating site administrators about social engineering attacks that attempt to trick them into clicking suspicious links from untrusted sources. Confirmation of the update can be verified via the plugin's version number displayed in the Plugins page or by inspecting the plugin file directly at admin/class-advanced-cf7-db-admin.php line 885, where proper nonce validation should now be present.