CVE-2026-12094 Overview
CVE-2026-12094 affects the Advanced Contact Form 7 - Compact DB plugin for WordPress in versions up to and including 1.0.0. The plugin exposes the cf7cdb_ajax_delete_user() AJAX handler without any authorization controls. Unauthenticated attackers can delete arbitrary contact form submission entries from the wp_cf7cdb_data table by supplying sequential primary-key IDs. The root cause is a missing capability check [CWE-862], compounded by the absence of nonce verification and ownership validation.
Critical Impact
Remote unauthenticated attackers can iterate integer IDs and delete every stored contact form submission, resulting in loss of business data such as inquiries, leads, and customer records.
Affected Products
- Advanced Contact Form 7 - Compact DB plugin for WordPress
- All versions up to and including 1.0.0
- Sites with the wp_cf7cdb_data table populated by Contact Form 7 submissions
Discovery Timeline
- 2026-06-24 - CVE-2026-12094 published to the National Vulnerability Database
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-12094
Vulnerability Analysis
The Advanced Contact Form 7 - Compact DB plugin stores Contact Form 7 (CF7) submissions in a custom database table named wp_cf7cdb_data. To allow administrators to remove individual entries from the admin interface, the plugin exposes an AJAX endpoint backed by the cf7cdb_ajax_delete_user() function.
The handler is registered against two WordPress AJAX hooks: wp_ajax_cf7cdb_delete and wp_ajax_nopriv_cf7cdb_delete. The nopriv registration exposes the action to unauthenticated visitors. Inside the function, the plugin reads an attacker-supplied integer ID from the request and passes it directly to $wpdb->delete() against wp_cf7cdb_data.
The handler performs no check_ajax_referer() nonce verification, no current_user_can() capability check, and no ownership validation. Any HTTP client able to reach /wp-admin/admin-ajax.php can therefore destroy submission records at will.
Root Cause
The root cause is Missing Authorization [CWE-862]. The cf7cdb_ajax_delete_user() function performs a privileged destructive database operation without verifying the caller's identity, capabilities, or intent. Registering the handler under wp_ajax_nopriv_cf7cdb_delete extends the impact to unauthenticated users.
Attack Vector
An attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to cf7cdb_delete and an ID parameter containing the primary key of the target row. Iterating IDs from 1 upward enables bulk deletion of every stored submission. The attack requires no authentication, no user interaction, and no prior reconnaissance beyond confirming the plugin is installed.
No public proof-of-concept exploit was referenced in the NVD entry. Technical details are documented in the WordPress plugin source code and the Wordfence Vulnerability Report.
Detection Methods for CVE-2026-12094
Indicators of Compromise
- HTTP POST requests to /wp-admin/admin-ajax.php containing the parameter action=cf7cdb_delete from unauthenticated sessions or unfamiliar IP addresses.
- Unexpected gaps in the id primary-key sequence of the wp_cf7cdb_data table.
- Sudden drop in stored Contact Form 7 submission counts that does not correspond to administrator activity.
Detection Strategies
- Inspect web server access logs for requests to admin-ajax.php with the cf7cdb_delete action and no authenticated session cookie.
- Compare submission counts against email notifications sent by Contact Form 7 to identify records that were stored and then removed.
- Enable WordPress database query logging or audit plugins to capture DELETE statements against wp_cf7cdb_data.
Monitoring Recommendations
- Forward web server and WordPress audit logs to a centralized logging platform and alert on high-volume admin-ajax.php requests carrying the cf7cdb_delete action.
- Baseline daily submission insert versus delete ratios and trigger an alert when deletions exceed normal administrator workflow patterns.
- Monitor for sequential ID enumeration patterns originating from a single source IP within short time windows.
How to Mitigate CVE-2026-12094
Immediate Actions Required
- Deactivate the Advanced Contact Form 7 - Compact DB plugin until a patched release is available.
- Back up the wp_cf7cdb_data table so destroyed submissions can be restored if an attack occurs.
- Restrict access to /wp-admin/admin-ajax.php at the web application firewall layer, blocking the cf7cdb_delete action for unauthenticated requests.
Patch Information
As of the last NVD update on 2026-06-25, no fixed version has been listed for the Advanced Contact Form 7 - Compact DB plugin. Administrators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org repository for a release that adds nonce verification, capability checks, and removal of the wp_ajax_nopriv_cf7cdb_delete registration.
Workarounds
- Add a web application firewall rule to block requests to admin-ajax.php where the action parameter equals cf7cdb_delete.
- Replace the plugin with an alternative submission storage solution that enforces capability checks on destructive operations.
- Limit access to /wp-admin/admin-ajax.php by IP address where operationally feasible, particularly from administrator workstations only for actions involving plugin management.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
