What is the CVSS score of CVE-2026-65540?

CVE-2026-65540 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Popup for CF7 are affected by CVE-2026-65540?

The 'Popup for CF7 with Sweet Alert' WordPress plugin (versions through 1.6.5) contains a cross-site request forgery vulnerability that enables unauthenticated attackers to manipulate authenticated…

How to fix or mitigate CVE-2026-65540?

Within 24 hours, audit your WordPress installation for 'Popup for CF7 with Sweet Alert' version 1.6.5 or earlier; if present, immediately restrict administrator dashboard access to known IP ranges and document all current plugin configurations as a baseline. Within 7 days, monitor the plugin repository and Patchstack advisories for security updates; evaluate alternative contact form solutions with active security maintenance as a backup plan. Within 30 days, either deploy the patched version when released or migrate to a maintained alternative plugin and remove 'Popup for CF7 with Sweet Alert' completely from all WordPress instances.

Popup for CF7 CVE-2026-65540

EUVD-2026-48141 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-q9m8-pgfw-cff6

CSRF Popup For Cf7 With Sweet Alert WordPress Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network CSRF (PR:N, AV:N, AC:L) that hinges on tricking a logged-in victim (UI:R), crossing a trust boundary (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:26 vuln.today

CVE Published

Jul 23, 2026 - 11:19 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

AnalysisAI

Cross-Site Request Forgery in the WordPress plugin 'Popup for CF7 with Sweet Alert' (by Metin Saraç) through version 1.6.5 allows a remote unauthenticated attacker to trick an authenticated site user or administrator into unknowingly submitting state-changing plugin requests. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope-change impact but requires victim interaction (clicking an attacker-controlled link/page). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin that integrates SweetAlert-style popups with Contact Form 7 (CF7) forms, tracked by CPE cpe:2.3:a:metin_saraç:popup_for_cf7_with_sweet_alert. The root cause is CWE-352 (Cross-Site Request Forgery): the plugin performs sensitive actions without validating an anti-CSRF token (WordPress nonce) or verifying request origin. Because WordPress plugins execute privileged admin-side operations tied to the logged-in user's session cookie, a missing nonce check lets a forged cross-origin request ride the victim's authenticated session to invoke plugin functionality the attacker could not otherwise reach.

RemediationAI

No vendor-released patch version was identified in the provided data; the advisory indicates versions up to 1.6.5 are affected, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/cf7-sweet-alert-popup/vulnerability/wordpress-popup-for-cf7-with-sweet-alert-plugin-1-6-5-cross-site-request-forgery-csrf-vulnerability-2) and the WordPress plugin repository for a release above 1.6.5 and upgrade as soon as one is published. Until a fixed version is confirmed, deactivate and remove the plugin if the SweetAlert popup functionality is non-essential (trade-off: loss of the CF7 popup feature), or place the wp-admin interface behind a virtual-patching WAF/CSRF rule such as Patchstack's own protection. Additionally, instruct privileged users not to click untrusted links while logged into wp-admin and consider shortening admin session lifetimes to narrow the exploitation window.