Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter
medium
The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, which is registered to both the wp_ajax_remove_abandoned and w...
- CVSS:
- 5.3
- Affected:
- up to 2.2
- Fix:
- No patched version reported
- Disclosed:
- Jun 15, 2026
CVE-2026-9187 on NVD →
Abandoned Contact Form 7 < 2.9 - Missing Authorization
medium
The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and excluding, 2.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.
- CVSS:
- 5.3
- Affected:
- up to 2.9
- Fixed in:
- 2.9
- Disclosed:
- Jun 23, 2025
CVE-2025-52817 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database