WP Comment Cleaner CVE-2026-107791

Exploitation requires an authenticated account on the target WordPress site at subscriber level or above (PR:L); the flaw lies in a specific bulk comment-deletion routine in WP Comment Cleaner before 7.2 that omits both the capability check and nonce validation. Practical exploitation is easiest where the site permits self-service user registration, since that lets an attacker obtain the needed minimal account; sites that disable open registration and tightly control accounts substantially limit the attacker population. No special plugin configuration is needed beyond having WP Comment Cleaner (6.1 to before 7.2) installed and active, and the impact is limited to destruction of comment data (no confidentiality or service-availability impact).

This is a moderate-priority access-control flaw, not a code-execution emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) indicates a network-reachable, low-complexity attack requiring only low privileges (PR:L) and no user interaction, with impact confined to integrity (I:H) - consistent with CWE-862 Missing Authorization. The key limiter is PR:L: an attacker must hold a valid, if minimal, account (e.g., subscriber), so this is not a pre-auth internet-wide issue. No EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; there is no SSVC decision data supplied. The realistic risk is elevated on sites that allow open user registration (common for blogs/communities), where obtaining a subscriber account is trivial and the flaw lets any such account wipe all site comments - a destructive but non-confidentiality, non-availability-of-service outcome. No signals conflict materially; the main caveat is that impact was scored as integrity (I:H) rather than availability even though the effect is permanent data loss of comment content, which some analysts would map to A:H instead.

An attacker registers (or uses) a low-privilege subscriber account on a site running WP Comment Cleaner before 7.2, then sends a crafted request to the vulnerable bulk comment-deletion route, which performs neither a capability check nor nonce validation. The request executes and permanently deletes every comment on the site. No public exploit code is identified at time of analysis, and the low attack complexity means the request can be scripted once the endpoint is known.