CVE-2026-75018
Received Received - Intake

Authorization Bypass in Custom Contact Forms WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: Wordfence

Description
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-75018
EUVD
EUVD-2026-71933

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
custom_contact_forms custom_contact_forms to 7.16 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Custom Contact Forms plugin for WordPress has an authorization bypass flaw in versions up to 7.16. Authenticated attackers with contributor-level access or higher can permanently delete any posts, including pages and WooCommerce products, and write arbitrary post meta data. The vulnerability occurs because nested field IDs are not properly checked for authorization, unlike top-level forms.

Detection Guidance

To detect this vulnerability, check for unauthorized deletion of posts or modification of post meta in WordPress. Review logs for actions by contributor-level users or above that involve deleting posts or writing to ccf_field_* meta. Use WordPress admin logs or security plugins to monitor such activities.

Impact Analysis

If you use this plugin, attackers could delete important content like pages or products and inject unauthorized data. This could disrupt your website, cause data loss, and compromise functionality. Contributor-level users or higher are the primary risk.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or modification, violating integrity and availability requirements in GDPR and HIPAA. Loss of critical data may result in non-compliance, potential fines, and reputational damage.

Mitigation Strategies

Immediately update the Custom Contact Forms plugin to the latest version if available. If not, consider disabling the plugin until a patch is released. Restrict contributor-level and higher user roles to only necessary permissions. Monitor for unauthorized post deletions or meta changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75018. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart