Insufficient Capability Check in WP Comment Cleaner Plugin by WordPress
CVE-2026-107791
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-107791?
The WP Comment Cleaner plugin for WordPress prior to version 7.2 contains a flaw where it does not adequately secure its bulk comment deletion function. This oversight allows authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on a WordPress site without the necessary capability checks or nonce validation, leading to potential data loss and undermining site integrity.
Affected Version(s)
WP Comment Cleaner 6.1 < 7.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.