CVE-2026-12094: Advanced Contact Form 7 Compact DB Unauthorized Data Deletion Vulnerability

Technical summary

The vulnerability exists in the cf7cdb_ajax_delete_user() AJAX handler, which is registered for both authenticated and unauthenticated requests (wp_ajax_cf7cdb_delete and wp_ajax_nopriv_cf7cdb_delete). The function accepts an attacker-supplied integer ID parameter and directly executes $wpdb->delete() against the wp_cf7cdb_data table without nonce verification, capability checks, or record ownership validation. This allows sequential ID enumeration and deletion of arbitrary contact form records.

Business impact

Organizations relying on the plugin to collect and retain contact form submissions face data loss and potential compliance violations. Customer inquiries, support requests, or sensitive submissions could be permanently deleted, disrupting business operations and damaging client relationships. Sites handling GDPR-regulated or otherwise sensitive contact data may face additional regulatory exposure if attackers exploit this to erase audit trails or customer records.

Affected systems

WordPress installations using Advanced Contact Form 7 - Compact DB plugin version 1.0.0 and earlier. The vulnerability affects both publicly accessible and internally deployed WordPress sites, since the AJAX handler permits unauthenticated requests. Any site without restrictive firewall or Web Application Firewall rules blocking the vulnerable endpoint is susceptible.

Exploitability

Exploitation is straightforward and requires no special skills or authentication. An attacker needs only to send HTTP requests to the WordPress AJAX endpoint with sequential form submission IDs. The lack of authentication, nonce checks, and access controls means the attack can be automated at scale. No user interaction or complex attack chain is required, making this a low-barrier exploit.

Remediation

Update the Advanced Contact Form 7 - Compact DB plugin to a version that implements proper capability checks, nonce verification, and record ownership validation before allowing deletions. Site administrators should immediately verify that plugin updates are available from the vendor and apply them. As a temporary mitigation, consider disabling the plugin or restricting AJAX endpoint access via firewall or WAF rules until a patch is confirmed.

Patch guidance

Check the plugin's official WordPress repository or vendor advisory for a patched version released after June 24, 2026. Apply the update as soon as it becomes available. After patching, verify in the plugin code that cf7cdb_ajax_delete_user() now includes current_user_can() capability checks, proper nonce validation via wp_verify_nonce(), and ownership verification before deletion. Test on a staging environment first to ensure compatibility.

Detection guidance

Monitor web server logs and WordPress debug logs for POST requests to /wp-admin/admin-ajax.php?action=cf7cdb_delete or action=cf7cdb_delete_nopriv with sequential or unusual ID parameters, particularly from unauthenticated sessions. Enable WordPress security logging to capture AJAX requests and failed deletion attempts. A spike in 200 responses to these endpoints from a single IP or over a short time window may indicate exploitation. Review the wp_cf7cdb_data table row counts and audit logs for unexpected deletions.

Why prioritize this

Although CVSS rates this as MEDIUM (5.3), the ease of exploitation and direct impact on data integrity make it a priority for rapid patching. The lack of any security control, combined with unauthenticated access, elevates real-world risk above the numerical score. Organizations that rely on contact forms for lead generation, customer support, or compliance documentation should treat this as HIGH priority operationally.

Risk score, explained

CVSS 3.1 assigns a score of 5.3 (MEDIUM) based on network accessibility, low attack complexity, no authentication requirement, and integrity impact (data deletion). However, the score reflects absence of confidentiality impact and does not account for business context or data sensitivity. The low barrier to exploitation and potential for automated attack warrant aggressive patching despite the medium CVSS rating.

Frequently asked questions