Unauthorized Data Deletion Vulnerability in Advanced Contact Form 7 - Compact DB for WordPress

CVE-2026-12094

What is CVE-2026-12094?

The Advanced Contact Form 7 - Compact DB plugin for WordPress contains a vulnerability that allows unauthorized deletion of data. This issue arises from a missing capability check in the cf7cdb_ajax_delete_user() function, along with the absence of nonce verification and ownership checks. As a result, unauthenticated attackers can exploit this flaw by sending specially crafted requests to delete arbitrary entries from the wp_cf7cdb_data table, using sequential primary-key IDs. Users of the plugin are urged to assess their installations and implement necessary security measures to protect their data.

References