Authorization Bypass in Custom Contact Forms Plugin for WordPress

CVE-2026-75018

What is CVE-2026-75018?

The Custom Contact Forms plugin for WordPress has a critical authorization bypass vulnerability that affects all versions up to and including 7.16. This flaw arises from insufficient user verification, allowing authenticated users with contributor-level access or higher to forcefully delete any post type, including pages and products, indiscriminately. Additionally, it permits the writing of arbitrary post metadata, compromising the integrity of the site's content and user permissions. The plugin performs checks at the top level for basic operations, but nested fields and choices lack equivalent safeguards, exposing critical functionalities that were evidently acknowledged by developers due to their inclusion of post-type restriction fixes in other areas of the code.

References