{"id":"CVE-2026-107791","aliases":["EUVD-2026-97244","GHSA-p3pc-rx4j-4w3p"],"status":"published","title":"WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment","description":"The WP Comment Cleaner  WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00178,"percentile":0.07474,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-10-12T06:00:08Z","modified":"2026-10-13T16:29:21Z","products":[{"vendor":"unknown","product":"wp comment cleaner"}],"references":[{"url":"https://wpscan.com/vulnerability/138aae16-6f2c-4477-9518-f120a61577d1/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107791"},{"url":"https://wpscan.com/vulnerability/138aae16-6f2c-4477-9518-f120a61577d1"},{"url":"https://github.com/advisories/GHSA-p3pc-rx4j-4w3p"}],"sources":{"cve":[{"id":"CVE-2026-107791","title":"WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment","description":"The WP Comment Cleaner  WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.","status":"published","published":"2026-10-12T06:00:08.827Z","modified":"2026-10-12T11:37:33.565Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:45:25.313702Z"}],"euvd":[{"id":"EUVD-2026-97244","description":"The WP Comment Cleaner  WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.","status":"published","published":"2026-10-12T06:00:08Z","modified":"2026-10-12T11:37:33Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:22.074542Z"}],"ghsa":[{"id":"GHSA-p3pc-rx4j-4w3p","title":"The WP Comment Cleaner  WordPress plugin before 7.2 does not perform a capability check or...","description":"The WP Comment Cleaner  WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.","status":"published","published":"2026-10-12T06:31:16Z","modified":"2026-10-12T12:31:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:13:05.860723Z"}],"nvd":[{"id":"CVE-2026-107791","description":"The WP Comment Cleaner  WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.","status":"published","published":"2026-10-12T06:16:58.82Z","modified":"2026-10-13T16:29:21.907Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:56.310333Z"}]}}