PT-2026-51671 · Iamranit · Advanced Contact Form 7 – Compact Db

Yu-Sheng Yu · Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-12094

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the cf7cdb ajax delete user() function in versions up to, and including, 1.0.0. The handler is registered against both wp ajax cf7cdb delete and wp ajax nopriv cf7cdb delete, and it performs no nonce verification, no capability check, and no ownership check before invoking $wpdb->delete() against the wp cf7cdb data table with an attacker-supplied integer ID. This makes it possible for unauthenticated attackers to delete arbitrary contact form submission entries stored by the plugin by iterating sequential primary-key IDs.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-12094

Produtos afetados

Advanced Contact Form 7 – Compact Db

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-12094 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php#L104 · Nota
• https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php#L115 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/3fa5ddd8-8166-45eb-9576-8683c1d12cc6?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php#L120 · Nota