CVE-2026-12094

The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the cf7cdb_ajax_delete_user() function in versions up to, and including, 1.0.0. The handler is registered against both `wp_ajax_cf7cdb_delete` and `wp_ajax_nopriv_cf7cdb_delete`, and it performs no nonce verification, no capability check, and no ownership check before invoking `$wpdb->delete()` against the `wp_cf7cdb_data` table with an attacker-supplied integer ID. This makes it possible for unauthenticated attackers to delete arbitrary contact form submission entries stored by the plugin by iterating sequential primary-key IDs.

• CWE-862

• https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php#L104
• https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php#L115
• https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php#L120
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa5ddd8-8166-45eb-9576-8683c1d12cc6?source=cve

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12085IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM …6.5
• CVE-2026-12086IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3…5.5
• CVE-2026-12087Socket versions before 2.041 for Perl have an out-of-bounds …9.1
• CVE-2026-12089The LWS Optimize – All-in-One Speed Booster & Cache Tools pl…4.9
• CVE-2026-12090The Taskbuilder – Project Management & Task Management Tool …6.5
• CVE-2026-12093The Simple Membership plugin for WordPress is vulnerable to …5.3
• CVE-2026-12095The Kargo Takip plugin for WordPress is vulnerable to Server…7.2
• CVE-2026-12097The User Management plugin for WordPress is vulnerable to au…5.3
• CVE-2026-12098The PowerPress Podcasting plugin by Blubrry plugin for WordP…6.4
• CVE-2026-1210The Happy Addons for Elementor plugin for WordPress is vulne…6.4
• CVE-2026-12100The URL Preview plugin for WordPress is vulnerable to Server…7.2
• CVE-2026-12102The UsersWP – Front-end login form, User Registration, User …2.7