Delete All Comments EUVD-2026-93085

Requires a valid authenticated account at subscriber level or higher on a WordPress site running the Delete All Comments of wordpress plugin version 7.1 or earlier; the plugin's bulk comment-deletion function omits the capability/authorization check (CWE-862). Exploitation is limited by the need for an account - realistic only where self-registration is enabled or credentials are otherwise obtainable. No user interaction, no admin privileges, and no non-default configuration are needed beyond the plugin being installed and active. Impact is confined to deletion of comment data (availability); confidentiality and site integrity are not affected.

This is a moderate, not critical, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable flaw that is easy to execute but requires low-level authentication (PR:L - a subscriber account), with no confidentiality or integrity loss and only availability impact (destruction of comment data). The CWE-862 (Missing Authorization) classification aligns with the 'Subscriber Broken Access Control' description: a low-privileged user can invoke a privileged delete function. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active or automated exploitation. The signals are internally consistent - the main caveat is that the 'Authentication Bypass' tag overstates the issue; this is an authorization (access control) failure requiring a valid subscriber session, not an unauthenticated bypass, consistent with PR:L. Net: a genuine data-destruction bug worth patching on affected sites that allow user registration, but low urgency given the authentication requirement, niche plugin footprint, and absence of exploitation signals.

An attacker registers or obtains a low-privilege subscriber account on a WordPress site running the Delete All Comments of wordpress plugin (<= 7.1), then sends a crafted authenticated request to the plugin's bulk comment-deletion function, which lacks a capability check. All comments across the site are deleted, causing loss of community content and discussion history. No public exploit code was identified at the time of analysis.