Delete All Comments Of Wordpress
Monthly
Broken access control in the Delete All Comments WordPress plugin through version 7.1 allows any authenticated subscriber-level account to invoke bulk comment-deletion functionality without the required capability check, causing high availability impact to comment data on affected sites. The assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms remote, low-privilege exploitation with no user interaction, while confidentiality and integrity are unaffected; this is a moderate, not critical, priority. No CISA KEV confirmation and no public exploit identified at time of analysis are present in the supplied intelligence, and exploitation is realistic mainly where self-registration or obtainable subscriber credentials exist.
Broken access control in the Delete All Comments WordPress plugin through version 7.1 allows any authenticated subscriber-level account to invoke bulk comment-deletion functionality without the required capability check, causing high availability impact to comment data on affected sites. The assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms remote, low-privilege exploitation with no user interaction, while confidentiality and integrity are unaffected; this is a moderate, not critical, priority. No CISA KEV confirmation and no public exploit identified at time of analysis are present in the supplied intelligence, and exploitation is realistic mainly where self-registration or obtainable subscriber credentials exist.