Security Alert Summary
The WP Comment Cleaner plugin before 7.2 contains a privilege/authorization bypass in a bulk comment-deletion routine. The plugin does not perform a capability check or validate a nonce for that routine, which allows authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
CVE Details
- CVE ID:
CVE-2026-107791 - Affected component: WP Comment Cleaner WordPress plugin
- Affected versions: Versions before 7.2 (the affected data lists version 6.1 as an example)
- Published: October 12, 2026 at 6:16:58 AM UTC
- Last modified: October 12, 2026 at 12:17:13 PM UTC
- CVSS v3.1 base score: 6.5
- CVSS v3.1 severity: MEDIUM
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Authentication / privileges / user interaction:
- Authentication required: yes (privileges required: LOW)
- User interaction: NONE
- Attack vector: NETWORK; Attack complexity: LOW; Scope: UNCHANGED
- Primary impact:
- Confidentiality: NONE
- Integrity: HIGH (ability to delete all comments)
- Availability: NONE
- Weakness (CWE): CWE-862
Technical Details
The vulnerability exists because a bulk comment-deletion routine in the WP Comment Cleaner plugin does not perform a capability check and does not validate a nonce before performing the deletion action. As described in the advisory, these missing checks allow any authenticated user with minimal permissions (for example, a subscriber role) to invoke the routine and permanently delete all comments on the affected site.
The issue is an authorization bypass: the plugin fails to confirm that the calling user has the appropriate capability to manage or delete comments and fails to validate the expected request nonce. No specific functions or REST endpoints are named in the provided data; the description identifies the problem in a bulk comment-deletion routine only.
Impact is limited to integrity of comment data: comments can be removed permanently. The CVSS data reflects no direct confidentiality or availability impact, but the deletion of comments can remove logs and public content that site administrators or moderators may rely on.
How This Could Impact Your Website
Consider a small team running a WordPress site: a site owner, an editor or moderator, and one or more contributors or external contractors with low-level accounts. If an attacker or a misbehaving authenticated user with subscriber-level access triggers the vulnerable bulk-delete routine, all comments on the site could be deleted.
- Permanent loss of comment history that staff use for moderation, customer feedback, or dispute resolution.
- Removal of audit trails and public content that could hinder investigations into abuse or misconduct.
- Although the CVSS data shows no direct confidentiality impact, deletion of comments can indirectly increase risk: public comments sometimes contain contact details or context that help detect targeted phishing or social engineering attempts, and losing that context can make targeted attacks easier to mount or harder to detect.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially accounts with contributor or subscriber access that are not needed.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and comment logs for unusual deletion events or bulk actions.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
