CVE-2023-23899: Hasthemes Extensions For CF7

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Extensions For CF7 plugin <= 2.0.8 versions leads to arbitrary plugin activation.

Affected products

• Hasthemes Extensions For CF7: before 2.0.9 (fixed in 2.0.9)

Published 2023-02-17. Last modified 2026-06-17.