The Advanced Contact Form 7 – Compact DB plugin for WordPress contains a missing capability check in the cf7cdb_ajax_delete_user() function. The AJAX handler is registered for both authenticated and unauthenticated requests, performs no nonce verification, no ownership check, and immediately executes a SQL delete on the wp_cf7cdb_data table using an attacker‑supplied primary key. This allows an unauthenticated attacker to remove any stored contact form submission simply by iterating numeric IDs, thereby deleting data that may include sensitive user information.

The vulnerability affects the Advanced Contact Form 7 – Compact DB plugin (vendor iamranit) in all releases up to and including version 1.0.0. The plugin stores its data in the WordPress database table wp_cf7cdb_data and relies on the AJAX endpoint cf7cdb_delete for deletion operations.

The CVSS score of 5.3 indicates a moderate severity vulnerability. Exploitation requires no authentication and can be performed with a basic HTTP request to the cf7cdb_delete endpoint containing a sequential form_id. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the absence of any authorization or nonce controls means an attacker can reliably delete arbitrary entries. The impact is loss of data integrity and potential loss of critical user submissions.