PT-2026-51671 · Iamranit · Advanced Contact Form 7 – Compact Db

Yu-Sheng Yu · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-12094

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the cf7cdb ajax delete user() function in versions up to, and including, 1.0.0. The handler is registered against both wp ajax cf7cdb delete and wp ajax nopriv cf7cdb delete, and it performs no nonce verification, no capability check, and no ownership check before invoking $wpdb->delete() against the wp cf7cdb data table with an attacker-supplied integer ID. This makes it possible for unauthenticated attackers to delete arbitrary contact form submission entries stored by the plugin by iterating sequential primary-key IDs.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-12094

Affected Products

Advanced Contact Form 7 – Compact Db

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-12094 · Security Note
• https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php#L104 · Note
• https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php#L115 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3fa5ddd8-8166-45eb-9576-8683c1d12cc6?source=cve · Note
• https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php#L120 · Note