The Custom Contact Forms plugin for WordPress contains an authorization bypass flaw that permits authenticated users with contributor‑level or higher permissions to perform privileged actions that should be restricted to administrators. Specifically, the plugin fails to verify that the requesting user has the correct capability when processing the nested fields[].ID and choices[].ID parameters in the _create_and_map_fields() and _create_and_map_choices() methods. As a result, an attacker can permanently delete any post—regardless of ownership or post type—including pages, admin‑authored posts and WooCommerce products, and can write arbitrary ccf_field_* post meta entries onto any post. This flaw is a CWE‑862 type weakness involving missing authorization checks.

Affected systems include the WordPress Custom Contact Forms plugin developed by outlawgt. Every release up to and including version 7.16 contains this vulnerability. The issue is present in the 7.15.0 and 7.15.2 tag sources, and the fix appears in version 7.17 and later.

The CVSS v3 score of 4.3 indicates moderate severity, and no EPSS value is available, while the vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploitation yet. Nonetheless, the attack requires only contributor‑level access, which is commonly granted on multi‑user sites. Based on the description, it is inferred that the vulnerability can be exploited by crafting HTTP requests that target the plugin’s API endpoints and include specially formed nested ID parameters, thereby bypassing normal capability checks and deleting or modifying content. The absence of a publicly available exploit does not reduce risk for sites that grant contributor permissions to users.