Description

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T06:16:58.820Z",
  "pubdate": "2026-10-12T06:16:58.820Z",
  "executiveSummary": "The WP Comment Cleaner WordPress plugin prior to version 7.2 contains a critical broken access control vulnerability.\nThe vulnerability allows authenticated users with minimal privileges, specifically subscribers, to trigger unauthorized bulk deletion of all site comments.\nThis flaw stems from a lack of server-side capability checks and missing CSRF (Cross-Site Request Forgery) protection on sensitive administrative routines.\nThe impact is a significant loss of data integrity and availability, as an attacker can permanently remove all comment history without elevated administrative privileges.\nThe vulnerability requires an attacker to be authenticated as a registered user, but does not require administrative or author-level permissions, expanding the potential attack surface to any subscriber on the platform.\nThere is no indication of remote code execution; however, the unauthorized modification of database content remains a high-risk security event.",
  "technicalDetails": "The root cause of this vulnerability is the absence of security-critical validation logic within the bulk comment-deletion routine of the WP Comment Cleaner plugin.\nSpecifically, the plugin fails to implement the current_user_can() function to verify if the requester holds the 'manage_options' or similar administrative capabilities necessary to perform destructive administrative actions.\nFurthermore, the affected endpoint does not utilize nonce verification, rendering it susceptible to unauthorized requests that bypass typical WordPress security posture.\nAn attacker can exploit this by crafting a direct HTTP POST request to the plugin's vulnerable bulk-action handler. Because the server does not validate the security token (nonce) or the user's role authorization, the application process proceeds to execute the database operation intended only for privileged users.\nThe attack flow follows a predictable sequence: First, the attacker authenticates as a subscriber. Second, the attacker discovers the specific request structure required by the plugin's bulk deletion routine. Third, the attacker sends a request to the backend with the necessary parameters to trigger the deletion loop.\nUpon receiving the malicious request, the server executes the SQL queries or the WordPress core functions tasked with comment removal on the entire database table. This action is irreversible via the plugin interface and results in the permanent loss of comment metadata and content.\nThis vulnerability is classified as an authorization bypass. The lack of strict parameter validation and permission checks at the entry point of the routine enables a user with low-level 'subscriber' privileges to act with the authority of an administrator regarding the comment deletion functionality.\nAffected versions include all releases of WP Comment Cleaner prior to 7.2. The vulnerability is persistent as long as the plugin remains installed and unpatched, providing a direct vector for unauthorized administrative actions against the WordPress site data layer."
}