Description

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-05T08:16:40.397Z",
  "pubdate": "2026-09-05T08:16:40.397Z",
  "executiveSummary": "The Custom Contact Forms plugin for WordPress, in versions up to and including 7.16, is susceptible to an authorization bypass vulnerability.\nThis security flaw arises from inadequate capability checks when processing nested data structures within the plugin's form handling logic.\nAuthenticated attackers possessing contributor-level privileges or higher can leverage this vulnerability to perform unauthorized administrative actions, specifically the permanent deletion of arbitrary post types and the unauthorized modification of post metadata.\nThe scope of potential impact includes, but is not limited to, the deletion of pages, administrative posts, and WooCommerce products, alongside the injection of arbitrary 'ccf_field_*' post meta data on any post.\nThis vulnerability highlights a critical failure in enforcing WordPress capability checks for nested field and choice identifiers, despite the existence of hardened logic elsewhere in the codebase. Successful exploitation requires an authenticated session with contributor access, posing a significant risk to the integrity and availability of WordPress installations relying on this plugin.",
  "technicalDetails": "The vulnerability resides in the internal processing functions _create_and_map_fields() and _create_and_map_choices() within the Custom Contact Forms plugin. While the plugin correctly implements capability checks—specifically validating 'edit_post' or 'publish_posts'—for the top-level form ID, it fails to extend this validation to the nested 'fields[].ID' and 'choices[].ID' paths.\nThe root cause is a deficiency in input validation and authorization enforcement within these sub-paths. The developer demonstrated awareness of scoping requirements by implementing explicit post-type restrictions in the 'delete_item()' and 'delete_submission()' functions; however, these safeguards are not applied to the aforementioned vulnerable sinks.\nAn attacker with contributor privileges can bypass intended security constraints by manipulating the request parameters associated with these sub-paths. By supplying malicious identifiers to 'fields[].ID' or 'choices[].ID', the attacker can bypass the check intended to limit actions to authorized post types. The server-side logic executes the requested operations—specifically deletion and metadata modification—without verifying whether the authenticated user has the necessary 'edit_post' capabilities for the targeted post objects.\nThe attack flow proceeds as follows: 1) The attacker authenticates as a contributor. 2) The attacker crafts a request to the plugin's backend handler, targeting the 'fields[].ID' or 'choices[].ID' parameters. 3) The application validates the top-level form, granting access to the processing routine. 4) The routine reaches the vulnerable sinks that lack post-type or capability checks. 5) The server processes the malicious ID, allowing the deletion of any arbitrary post type (pages, admin posts, WooCommerce products) or the injection of arbitrary post meta prefixed with 'ccf_field_'.\nThis flaw allows for unauthorized persistence and data manipulation. The ability to write arbitrary metadata can potentially be leveraged for further privilege escalation or site-wide configuration changes depending on how the application utilizes 'ccf_field_*' meta keys. The absence of strict post-type guardrails renders the entire site architecture vulnerable to malicious modifications by low-privileged authenticated users."
}