Arbitrary Post Deletion in Abandoned Contact Form 7 Plugin for WordPress

CVE-2026-9187

What is CVE-2026-9187?

The Abandoned Contact Form 7 plugin for WordPress suffers from a critical security flaw whereby unauthorized users can delete posts and pages without proper verification. This vulnerability arises from missing capability checks and nonce validation within the action__remove_abandoned() function. Specifically, the wp_ajax_remove_abandoned and wp_ajax_nopriv_remove_abandoned hooks allow attackers to exploit the user-supplied recover_id parameter passed directly to the wp_delete_post() function. Because the parameter is not verified against the plugin's own data, unauthenticated attackers can effectively send a single AJAX request to delete any content on the site permanently.

References