Executive brief
The Custom Contact Forms WordPress plugin fails to properly verify user permissions when handling form fields and nested data, allowing contributors and higher-level users to permanently delete posts of any type (including published articles and products) and inject unauthorized metadata. This enables malicious insiders to destroy content or corrupt data without accountability.
Technical details
The plugin implements capability checks (edit_post/publish_posts) at the top-level form ID, but nested field and choice IDs processed by _create_and_map_fields() and _create_and_map_choices() lack equivalent authorization guards. Authenticated attackers with contributor-level access or above can exploit these unprotected code paths to force-delete arbitrary posts regardless of ownership or type, and write arbitrary ccf_field_* post metadata to any post. The vulnerability is a privilege escalation flaw in form API endpoints; no network attack required beyond initial WordPress authentication. Patches addressing post-type scoping are available in versions after 7.16.
Affected products
- Automattic Custom Contact Forms up to and including 7.16
Timeline
- 2026-09-05: disclosed