Abandoned Contact Form 7
Approved changes feed: RSS · Atom
cpe:2.3:a:zealopensource:abandoned_contact_form_7:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Zealopensource (f2ce713f-fe8a-5e28-9036-8f3d8a39b1b7) |
|---|---|
| Product | Abandoned Contact Form 7 (14fc5229-6695-54ef-9282-4f6146eedb75) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9187 |
vulnerable | 2026-07-29 01:09:06.779004 |
Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter
MEDIUM (5.3)
The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, which is registered to both the wp_ajax_remove_abandoned and wp_ajax_nopriv_remove_abandoned hooks. The handler takes a user-supplied recover_id parameter from $_POST and passes it directly to wp_delete_post() with the force-delete flag set to true, without verifying that the ID belongs to the plugin's own cf7af_data post type. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, or other content on the affected site by sending a single admin-ajax.
Published: 2026-06-16T04:30:15.996Z
Updated: 2026-06-16T12:37:54.599Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.