Advanced Contact Form 7 DB WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Advanced Contact Form 7 DB plugin for WordPress, affecting all versions up to and including 2.0.9. The vulnerability arises from inadequate nonce validation in the 'vsz_cf7_save_setting_callback' function, allowing unauthenticated attackers to delete form entries by tricking a site administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, enabling the deletion of form entries without proper authorization.

Reproduction

To reproduce this vulnerability, an attacker must send a forged request to a WordPress site with the vulnerable plugin installed. This can be done by tricking an administrator into clicking a link that contains the necessary parameters to delete a form entry, bypassing the missing nonce validation.

Remediation

Users are advised to update the Advanced Contact Form 7 DB plugin to version 2.1.0 or later, where this vulnerability has been patched.