EUVD-2026-38663
GHSA-7v85-67q3-8qc9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nopriv hook confirms PR:N; deletion via HTTP confirms AV:N/AC:L; impact is integrity-only on plugin table with no confidentiality or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the cf7cdb_ajax_delete_user() function in versions up to, and including, 1.0.0. The handler is registered against both wp_ajax_cf7cdb_delete and wp_ajax_nopriv_cf7cdb_delete, and it performs no nonce verification, no capability check, and no ownership check before invoking $wpdb->delete() against the wp_cf7cdb_data table with an attacker-supplied integer ID. This makes it possible for unauthenticated attackers to delete arbitrary contact form submission entries stored by the plugin by iterating sequential primary-key IDs.
AnalysisAI
Unauthenticated data deletion in the Advanced Contact Form 7 - Compact DB WordPress plugin (versions up to and including 1.0.0) allows any remote attacker to permanently destroy all stored contact form submissions. The root cause is registration of the deletion handler against the wp_ajax_nopriv_cf7cdb_delete hook, which WordPress exposes to unauthenticated users, combined with a complete absence of nonce verification, capability checks, and ownership validation before invoking $wpdb->delete(). No public exploit or CISA KEV listing has been identified at time of analysis, but exploitation is trivially automatable due to sequential integer primary keys and no authentication barrier.
Technical ContextAI
The affected plugin (CPE: cpe:2.3:a:iamranit:advanced_contact_form_7_-_compact_db:*:*:*:*:*:*:*:*) extends the popular Contact Form 7 WordPress plugin by persisting submission data to a custom table (wp_cf7cdb_data). WordPress distinguishes between wp_ajax_{action} hooks (authenticated users only) and wp_ajax_nopriv_{action} hooks (unauthenticated users). The vulnerable function cf7cdb_ajax_delete_user() at cf7cdb.php line 104/115 is registered against both, meaning the nopriv variant grants the full deletion capability to any unauthenticated HTTP client. The function passes an attacker-controlled integer directly to $wpdb->delete() without sanitization beyond an implicit integer cast. CWE-862 (Missing Authorization) precisely describes this failure: the application performs a privileged database write operation without verifying that the caller holds any capability to do so. Sequential auto-increment primary keys trivially enable full-table enumeration.
RemediationAI
No vendor-released patched version has been identified at time of analysis. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa5ddd8-8166-45eb-9576-8683c1d12cc6) should be monitored for patch availability. Until a fix is released, the primary compensating control is to deactivate and remove the plugin entirely - this eliminates the AJAX endpoint registration and removes all attack surface at the cost of losing in-database form submission storage (submissions would no longer be persisted). If the plugin must remain active, a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php with action=cf7cdb_delete will block automated exploitation but may require tuning to avoid disrupting legitimate admin traffic. Exporting and backing up the wp_cf7cdb_data table to an external system immediately is advisable given that existing submissions are at risk of deletion.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today