Executive brief
The Advanced Contact Form 7 - Compact DB plugin for WordPress, which stores contact form submissions in a database, contains a security flaw that allows anyone to delete saved form entries. An attacker can remotely remove these records without needing a password or any special permissions. This could lead to the permanent loss of customer inquiries, lead data, and communication history stored through the website's contact forms.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the cf7cdb_ajax_delete_user() function. The AJAX handler is registered for both authenticated and unauthenticated users via the wp_ajax_cf7cdb_delete and wp_ajax_nopriv_cf7cdb_delete hooks. The function fails to perform any nonce verification, capability checks, or ownership validation before executing a $wpdb->delete() call on the wp_cf7cdb_data table. An unauthenticated attacker can exploit this by sending a request with a specific integer ID, allowing for the deletion of arbitrary contact form submission entries through ID enumeration.
Affected products
- iamranit Advanced Contact Form 7 – Compact DB <= 1.0.0
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php
- https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php
- https://plugins.trac.wordpress.org/browser/advanced-contact-form-7-compact-db/trunk/cf7cdb.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa5ddd8-8166-45eb-9576-8683c1d12cc6?source=cve