The Delete All Comments of WordPress plugin allows any authenticated subscriber account to delete all comments on the site, bypassing the intended permission restrictions. This flaw stems from missing authorization checks on an action that should be restricted to higher‑privilege roles. Once exploited, an attacker can remove every comment on the website, affecting the site’s historical record and potentially disrupting discussion flow.

Vulnerable systems include WordPress sites that have installed the Delete All Comments of WordPress plugin version 7.1 or earlier, especially those where subscriber roles are allowed to use the plugin. The maintainers identified the product under the CNA designation royalnavneet:Delete All Comments of wordpress.

The CVSS score of 6.5 indicates a medium severity impact, while the EPSS score of less than 1% suggests a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of active exploitation. Based on the description, the likely attack vector is remote access through a legitimate subscriber account, requiring authentication but not elevated privileges. The attack path is straightforward once the plugin is installed and the user is authenticated, enabling a tenant to delete all comments without additional barriers.