The Conditional Fields for Contact Form 7 plugin for WordPress suffers from a CSRF vulnerability due to improper nonce validation in the wpcf7cf_admin_init function. This enables attackers to forge requests that reset plugin settings by leveraging the actions of authenticated administrators. The vulnerability affects all versions up to and including 2.4.13. The CVSS 3.1 base score is 4.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can cause a site administrator to unknowingly reset the plugin's settings via a forged request. This could disrupt the intended configuration of the Conditional Fields for Contact Form 7 plugin, potentially affecting site functionality related to contact forms. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider restricting administrative access or implementing additional CSRF protections at the site level.