CVE-2026-65540

An unauthenticated Cross Site Request Forgery (CSRF) vulnerability exists in versions of Popup for CF7 with Sweet Alert up to 1.6.5, allowing attackers to perform actions on behalf of users without their consent. This could lead to unauthorized changes or data exposure in web applications utilizing this plugin. Organizations using affected versions should prioritize patching to mitigate potential exploitation risks.