CVE-2026-9187: Abandoned Contact Form 7 WordPress Plugin Unauthenticated Post Deletion

Technical summary

The Abandoned Contact Form 7 plugin registers the action__remove_abandoned() function to handle AJAX requests via both wp_ajax_remove_abandoned and wp_ajax_nopriv_remove_abandoned hooks. The wp_ajax_nopriv variant permits unauthenticated access. The function accepts a recover_id parameter from POST data and passes it directly to wp_delete_post() with force deletion enabled, without verifying: (1) the user possesses delete capabilities, (2) a valid nonce token accompanies the request, or (3) the post ID actually belongs to the plugin's cf7af_data post type. This permits attackers to supply arbitrary post IDs and permanently remove any content from the WordPress installation.

Business impact

An attacker can selectively or indiscriminately destroy site content, including published posts, pages, portfolio items, or other critical information. This can damage reputation, disrupt service delivery, trigger data loss compliance issues, and require recovery from backups if available. Sites without frequent backups face permanent loss of content and SEO equity. The attack requires no authentication and can be automated, making large-scale attacks feasible.

Affected systems

WordPress installations running the Abandoned Contact Form 7 plugin in version 2.2 or earlier are vulnerable. Any WordPress site using this plugin for contact form data recovery functionality is at risk.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and only a single HTTP POST request to the WordPress admin-ajax endpoint. An attacker needs only to discover the target WordPress site and craft a POST request with an arbitrary post ID. Network accessibility to the WordPress installation is the only prerequisite, making this a low-friction attack surface. However, CVSS scoring reflects limited impact scope—the vulnerability enables integrity compromise (content deletion) but not confidentiality breaches or availability of the WordPress service itself.

Remediation

Update the Abandoned Contact Form 7 plugin to a version that includes the security patches addressing missing capability checks and nonce validation. Verify the patched version properly restricts the delete action to authenticated users with appropriate post deletion capabilities and validates nonce tokens on all AJAX requests.

Patch guidance

Check the plugin's official WordPress plugin repository or vendor advisory for the first patched version after 2.2 that resolves this vulnerability. Apply the update as soon as testing confirms compatibility with your site's theme and other plugins. If updating is delayed, consider temporarily deactivating the plugin to eliminate the attack surface.

Detection guidance

Monitor admin-ajax.php logs for POST requests to the remove_abandoned action from unauthenticated users or unusual IP ranges. Look for requests containing numeric recover_id parameters followed by posts being deleted without corresponding author activity or admin login sessions. Website integrity monitoring tools can detect unexpected post deletions. Consider enabling WordPress audit logging if available and reviewing post deletion events in WordPress activity logs. A sudden spike in deleted posts unrelated to site maintenance warrants immediate investigation.

Why prioritize this

Although rated MEDIUM severity due to limited impact scope, prioritize this vulnerability for rapid remediation because: (1) it requires zero authentication and zero user interaction, (2) the attack is trivial to execute and automate, (3) content destruction is permanent and difficult to reverse without backups, (4) the attack surface is present on any WordPress site using this plugin, and (5) attackers can easily enumerate and target many sites simultaneously. The combination of ease of exploitation and real business damage justifies urgent patching.

Risk score, explained

CVSS 5.3 (MEDIUM) reflects: network-based attack vector (AV:N), low attack complexity with no special conditions (AC:L), no privilege requirements (PR:N), no user interaction needed (UI:N), impact isolated to the affected system (S:U). The score penalizes the vulnerability because it does not compromise confidentiality (C:N) and affects integrity only in limited scope (I:L). However, CVSS does not account for the triviality of exploitation or the ease of attacking multiple targets; security teams should weight practical exploitability heavily in their risk assessment.

Frequently asked questions