The Abandoned Contact Form 7 plugin for WordPress allows an attacker to delete any post, page, or content on the site by exploiting a missing capability check and nonce validation. This flaw, identified by CWE-862, permits unauthorized users to send a crafted request to the wp_ajax_remove_abandoned action, which then calls wp_delete_post() directly with the force-delete flag. The result is permanent loss of data and potential disruption of site availability.

WordPress installations that have the Abandoned Contact Form 7 plugin installed, version 2.2 or earlier. Any site using this plugin in those versions is exposed to this deletion vulnerability.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Given that the malicious action can be performed via a simple admin‑ajax request without authentication, an attacker could target any such site by sending a single crafted HTTP POST. However, the low EPSS score and lack of active exploitation data imply that the overall risk is moderate, although the impact on data integrity and availability is significant.