Description

Subscriber Broken Access Control in Delete All Comments of wordpress <= 7.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-06T09:17:40.440Z",
  "pubdate": "2026-10-06T09:17:40.440Z",
  "executiveSummary": "A critical Broken Access Control vulnerability has been identified in WordPress versions <= 7.1, specifically affecting the functionality responsible for the bulk deletion of comments.\nThis vulnerability allows authenticated users with the 'Subscriber' role—who are typically restricted from administrative functions—to trigger the 'Delete All Comments' operation.\nThe flaw stems from insufficient server-side authorization checks, failing to validate whether the current user possesses the 'manage_options' or 'moderate_comments' capabilities before executing destructive database actions.\nThe primary risk implication is the potential for unauthorized data destruction, leading to a significant loss of integrity and availability of user-generated content.\nAn attacker requires a valid Subscriber account to exploit this flaw, which is often accessible via standard public registration systems.\nSuccessful exploitation results in the permanent removal of all comments within the database, which could facilitate disruptive malicious activity, vandalism, or an attempt to erase evidence of illicit behavior on the platform.",
  "technicalDetails": "The vulnerability resides within the comment management module of WordPress versions <= 7.1. The root cause is a missing capability check (e.g., current_user_can()) within the handler responsible for processing bulk comment deletion requests.\nIn the WordPress architecture, the 'Delete All Comments' function is intended to be restricted to high-privileged users, such as Administrators, who hold the necessary permissions to modify site-wide content and settings.\nThe technical failure occurs when the application receives an HTTP POST request targeting the administrative comment-processing endpoint. The controller logic fails to verify if the requester has the 'moderate_comments' capability, instead relying on implicit trust in the session.\nAn attacker can exploit this by intercepting the legitimate request used to clear comments and replaying it while authenticated as a standard Subscriber. Because the backend code executes the database deletion query (typically involving a DELETE FROM wp_comments SQL statement) without confirming the user's role, the operation succeeds.\nThe attack flow follows a structured pattern: 1) The attacker authenticates as a Subscriber using standard credentials. 2) The attacker identifies the endpoint responsible for the comment deletion administrative action. 3) The attacker crafts a request mimicking the structure of an administrative bulk-deletion operation. 4) The server processes the request, bypassing the lack of privilege validation, and executes the destructive query against the database.\nThe impact is immediate and significant: the entire comment history of the target installation is purged. Given that this vulnerability exists in versions up to 7.1, any site allowing public registration is potentially exposed if the deletion function is accessible to authenticated sessions. The lack of granular permission checks creates a privilege escalation scenario where the functional scope of a low-privileged account exceeds its intended limitations, effectively granting the subscriber the destructive power of a site administrator."
}