CVE-2026-0811 is a CSRF vulnerability in the Advanced Contact form 7 DB WordPress plugin (vsourz1td) affecting all versions up to 2.0.9. The issue is due to missing or incorrect nonce validation in the 'vsz_cf7_save_setting_callback' function, allowing unauthenticated attackers to perform unauthorized actions by tricking site administrators into executing forged requests. This can result in deletion of form entries. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity). No patch or official remediation has been published by the vendor as of the current data.

Successful exploitation allows an attacker to delete form entries without authentication by leveraging CSRF against site administrators. This impacts the integrity and availability of form data but does not affect confidentiality. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests that could trigger form entry deletions. Implementing additional CSRF protections or disabling the vulnerable functionality may reduce risk.