CVE-2026-0811
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9.
CVSS
5.4
Medium
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Published: Apr 8, 2026 · Last modified: Jul 25, 2026 · CWE-352
0.1%EPSS · 30 days0.1%
2026-09-282026-10-26
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/advanced-cf7-db/tags/2.0.9/admin/class-advanced-cf7-db-admin.php#L885
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset/3497481/advanced-cf7-db
- www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/88097744-d2f5-4ae5-aa71-0f4a0decd911?source=cve
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1175368.8 HIG—
——0REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.5hCVE-2026-1175345.4 MED—
——0REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.5hCVE-2026-1168955.4 MED—
——0REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.5hCVE-2026-1168807.1 HIG—
——0Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.5hCVE-2026-102787——
——0Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.56hCVE-2026-1168397.1 HIG—
——0A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.15h