CVE-2026-75018 Details
Description
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.
A vulnerability exists in the Custom Contact Forms plugin for WordPress, affecting all versions up to and including 7.16. The issue stems from the plugin's failure to properly verify user authorization for certain actions. This flaw enables authenticated attackers with contributor-level access or higher to permanently delete arbitrary posts of any type, including pages, posts authored by administrators, and WooCommerce products. Additionally, these attackers can write arbitrary post meta related to form fields onto any post, regardless of ownership or post type. The vulnerability arises because while the top-level form ID is checked for authorization, the nested fields and choices parameters lack equivalent safeguards, leaving those pathways exposed. Notably, the plugin's deletion functions do include post-type restrictions, indicating that the developer is aware of the need for proper scoping.
Users are advised to update the Custom Contact Forms plugin to version 7.16.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Custom Contact Forms | <= 7.16 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 7, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |