CVE-2026-75018: WordPress Custom Contact Forms Auth Bypass

CVE-2026-75018 Overview

CVE-2026-75018 is an authorization bypass vulnerability in the Custom Contact Forms plugin for WordPress affecting all versions up to and including 7.16. The flaw resides in the plugin's REST API form controller, where nested field and choice handlers skip the capability checks applied at the top-level form endpoint. Authenticated attackers holding contributor-level access or above can force-delete arbitrary posts of any type, including pages, administrator-authored content, and WooCommerce products. They can also write arbitrary ccf_field_* post meta onto any post regardless of ownership. The vulnerability is tracked under CWE-862: Missing Authorization.

Critical Impact
Contributor-level accounts can permanently destroy site content and inject arbitrary post meta across any post type, bypassing WordPress ownership controls.

Affected Products

Custom Contact Forms plugin for WordPress — all versions ≤ 7.16
WordPress sites exposing the plugin's REST API endpoints
WooCommerce deployments where the plugin is installed alongside product content

Discovery Timeline

2026-09-05 - CVE-2026-75018 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-75018

Vulnerability Analysis

The vulnerability sits inside class-ccf-api-form-controller.php, the REST controller that manages Custom Contact Forms form objects. The top-level form ID is validated using WordPress capability checks such as edit_post and publish_posts. However, the nested fields[].ID and choices[].ID identifiers submitted in the same request are consumed by _create_and_map_fields() and _create_and_map_choices() without equivalent authorization or post-type restrictions.

Because those helpers accept any post ID supplied by the caller, a contributor can direct the controller to operate on posts they do not own and post types the plugin was never intended to touch. The delete_item() and delete_submission() functions include explicit post-type restrictions, which shows the developer applied scoping in some paths but omitted it from the field and choice sinks.

Root Cause

The root cause is missing authorization on child object identifiers processed by the form save workflow. WordPress capability checks are enforced only against the form-level ID, so the nested IDs inherit no ownership or post-type context before being passed to update and delete operations.

Attack Vector

Exploitation requires an authenticated session with contributor privileges or higher. The attacker sends a crafted request to the plugin's form REST endpoint, embedding target post IDs inside the fields or choices arrays. The controller then force-deletes those posts or writes attacker-controlled ccf_field_* meta values onto them. Full technical details are available in the Wordfence Vulnerability Report and the affected WordPress Custom Contact Forms Code.

No public proof-of-concept exploit code has been published for this vulnerability.

Detection Methods for CVE-2026-75018

Indicators of Compromise

Unexpected wp_posts entries missing (force-deleted) shortly after REST calls to /wp-json/ccf/v1/forms from contributor accounts.
Presence of ccf_field_* keys in wp_postmeta on posts, pages, or WooCommerce products that were never associated with a Custom Contact Forms form.
REST API requests from low-privilege users containing nested fields[].ID or choices[].ID values pointing to unrelated post IDs.

Detection Strategies

Enable WordPress REST API request logging and alert on POST/PUT calls to Custom Contact Forms endpoints originating from contributor and author roles.
Baseline the expected post types associated with ccf_field_* meta keys and flag deviations, especially attachments to page, post, or product types.
Correlate bulk post deletions against the authenticated user's role to surface privilege-inconsistent activity.

Monitoring Recommendations

Ship WordPress access, audit, and database logs to a central analytics platform for role-versus-action correlation.
Monitor plugin version inventory across WordPress fleets and alert on any host still running Custom Contact Forms ≤ 7.16.
Track WooCommerce product deletion events and reconcile them with expected administrative workflows.

How to Mitigate CVE-2026-75018

Immediate Actions Required

Update the Custom Contact Forms plugin to a version released after 7.16 that includes the fix from the WordPress Changeset Update.
Audit contributor, author, and editor accounts for unexpected activity against form REST endpoints since installation.
Restore any force-deleted posts, pages, or WooCommerce products from backups and remove unauthorized ccf_field_* meta entries.

Patch Information

The vendor addressed the issue in the Custom Contact Forms changeset referenced in the plugin trac. Administrators should upgrade to the latest patched release via the WordPress plugin repository and verify the plugin version reports higher than 7.16 after update.

Workarounds

Deactivate the Custom Contact Forms plugin until the site can be updated to a patched release.
Restrict access to the plugin's REST namespace using a Web Application Firewall (WAF) rule that blocks contributor-level users from writing to /wp-json/ccf/v1/forms.
Temporarily reduce contributor and author accounts to subscriber level on high-value sites until remediation is verified.

bash

# Configuration example: disable the plugin from WP-CLI while patching
wp plugin deactivate custom-contact-forms
wp plugin update custom-contact-forms
wp plugin activate custom-contact-forms