{"id":"CVE-2026-75018","aliases":["EUVD-2026-71933","GHSA-f352-gm8p-p4mp"],"status":"published","title":"Custom Contact Forms \u003c= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters","description":"The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00491,"percentile":0.42663,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-09-05T07:38:14Z","modified":"2026-09-08T13:12:58Z","products":[{"vendor":"outlawgt","product":"custom contact forms"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a34ec54-7629-4c14-b5e0-d47f5d3a72ce?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L291"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L291"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L336"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L360"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L1026"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L993"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L977"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L336"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L360"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L1026"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L993"},{"url":"https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L977"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3669565%40custom-contact-forms\u0026new=3669565%40custom-contact-forms"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75018"},{"url":"https://github.com/advisories/GHSA-f352-gm8p-p4mp"}],"sources":{"cve":[{"id":"CVE-2026-75018","title":"Custom Contact Forms \u003c= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters","description":"The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.","status":"published","published":"2026-09-05T07:38:14.313Z","modified":"2026-09-07T11:17:24.787Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-71933","description":"The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.","status":"published","published":"2026-09-05T07:38:14Z","modified":"2026-09-07T11:17:24Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-f352-gm8p-p4mp","title":"The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all...","description":"The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.","status":"published","published":"2026-09-05T09:30:22Z","modified":"2026-09-05T09:30:28Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:11:24.999449Z"}],"nvd":[{"id":"CVE-2026-75018","description":"The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.","status":"published","published":"2026-09-05T08:16:40.397Z","modified":"2026-09-08T13:12:58.31Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:44.082631Z"}]}}