CVE-2026-107791
Received Received - Intake

Authenticated Comment Deletion in WP Comment Cleaner WordPress Plugin

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: WPScan

Description
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-107791
EUVD
EUVD-2026-97244

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown WP Comment Cleaner 6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Comment Cleaner WordPress plugin before version 7.2 has a flaw where it does not check user permissions or validate a security token (nonce) before allowing bulk deletion of comments. This lets any logged-in user, even those with basic subscriber access, permanently delete all comments on the site.

Detection Guidance

To detect this vulnerability, check the installed version of the WP Comment Cleaner plugin. If it is between 6.1 and 7.1, the site is vulnerable. You can verify this by inspecting the plugin files or using WordPress admin tools to view the plugin version.

Impact Analysis

If exploited, this vulnerability could lead to the permanent loss of all comments on your WordPress site. This may disrupt user engagement, remove valuable content, and require significant effort to restore or recreate lost discussions.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling unauthorized users to delete comments, which may include sensitive or regulated data. Unauthorized deletion of comments could lead to incomplete records, violating data retention requirements under GDPR Article 5 and HIPAA's integrity principles.

Mitigation Strategies

Immediately update the WP Comment Cleaner plugin to version 7.2 or later. If updating is not possible, consider disabling the plugin temporarily until an update can be applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107791. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart