This vulnerability, identified as CVE-2026-65540, affects the 'Popup for CF7 with Sweet Alert' plugin developed by Metin Saraç. It is an unauthenticated CSRF vulnerability present in versions up to and including 1.6.5. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated as low to low to low respectively. The vulnerability allows an attacker to trick a user into submitting unauthorized requests, potentially causing unintended actions within the affected plugin's context. No patch or official fix has been documented as of the publication date.

Successful exploitation of this CSRF vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user, potentially leading to partial loss of confidentiality, integrity, and availability within the affected plugin's functionality. Since the vulnerability is unauthenticated and requires user interaction, it could be leveraged in targeted attacks to manipulate plugin behavior or data. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting the use of the affected plugin to reduce exposure. Implementing standard CSRF protections or using security plugins that add CSRF tokens may help mitigate risk, but these are not guaranteed solutions specific to this vulnerability.