Description
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
Published: 2026-10-12
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized bulk comment deletion
Action: Immediate Patch
AI Analysis

Impact

The WordPress plugin WP Comment Cleaner, in all releases before 7.2, has a missing capability check and fails to validate a nonce in its bulk comment-deletion routine. This flaw allows any authenticated user, including those with the minimal subscriber role, to permanently remove every comment from the site, resulting in loss of discussion data and potential denial of service. The vulnerability exposes the integrity of site content but does not directly affect confidentiality or availability of other site resources.

Affected Systems

WP Comment Cleaner plugin for WordPress sites, versions 6.1 through 7.1.

Risk and Exploitability

The flaw requires only that an attacker possess a valid authenticated WordPress session, and can be exercised through the normal administrative interface. No additional privileges or exploitation software are needed. While the CVSS score of 6.5 indicates a moderate severity, the absence of proper authorization grants the attacker a high risk to data integrity. The vulnerability is not listed in the CISA KEV catalog at this time.

Generated by OpenCVE AI on October 12, 2026 at 13:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update WP Comment Cleaner to version 7.2 or later where the bulk delete capability is properly protected by a capability check and nonce validation.
  • If an upgrade is not immediately possible, restrict subscriber roles from accessing the bulk delete feature by removing the capability from that role using a role-management plugin or custom code.
  • Apply a temporary layer of protection by disabling the bulk delete endpoint or enforcing stricter capability checks through additional security plugins such as WordFence or iThemes Security.

Generated by OpenCVE AI on October 12, 2026 at 13:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-862
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Mon, 12 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
Title WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-12T11:37:33.565Z

Reserved: 2026-10-08T20:34:13.671Z

Link: CVE-2026-107791

cve-icon Vulnrichment

Updated: 2026-10-12T11:36:22.096Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T06:16:58.820

Modified: 2026-10-13T16:29:21.907

Link: CVE-2026-107791

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T13:30:13Z

Weaknesses