Custom Contact Forms
Monthly
Authorization bypass in the Custom Contact Forms WordPress plugin (all versions ≤ 7.16) grants authenticated contributors the ability to permanently force-delete arbitrary posts of any type - including administrator-authored pages and WooCommerce product listings - and write arbitrary ccf_field_* post meta onto any post regardless of ownership. The root cause is that _create_and_map_fields() and _create_and_map_choices() accept arbitrary post IDs in nested fields[].ID and choices[].ID parameters with no capability or post-type validation, leaving those REST API sinks fully unguarded while the developer had already implemented equivalent guards elsewhere in the same controller. No public exploit code exists and the vulnerability is not listed in CISA KEV.
Authorization bypass in the Custom Contact Forms WordPress plugin (all versions ≤ 7.16) grants authenticated contributors the ability to permanently force-delete arbitrary posts of any type - including administrator-authored pages and WooCommerce product listings - and write arbitrary ccf_field_* post meta onto any post regardless of ownership. The root cause is that _create_and_map_fields() and _create_and_map_choices() accept arbitrary post IDs in nested fields[].ID and choices[].ID parameters with no capability or post-type validation, leaving those REST API sinks fully unguarded while the developer had already implemented equivalent guards elsewhere in the same controller. No public exploit code exists and the vulnerability is not listed in CISA KEV.