CVE-2024-1777 is a Cross-Site Request Forgery vulnerability in the Admin side data storage component of the Contact Form 7 plugin by zestardtechnologies. The vulnerability is due to missing or incorrect nonce validation on the settings update function, which allows an attacker to forge requests that update plugin settings without proper authorization. This requires tricking a site administrator into performing an action such as clicking a crafted link. The vulnerability affects all versions up to and including 1.1.1 and has a CVSS 3.1 base score of 4.3 (medium severity). No patch or remediation details are currently available.

An attacker can cause unauthorized changes to the plugin's settings by exploiting the CSRF vulnerability if they can convince an administrator to perform an action like clicking a malicious link. This could lead to altered plugin behavior or configuration without the administrator's consent. There is no direct confidentiality or availability impact reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or requests that could trigger plugin settings changes. Monitoring vendor communications for updates or patches is recommended.