CVE-2026-107791: WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Sites using WP Comment Cleaner versions before 7.2 are affected. Any site where users can authenticate with minimal roles, including subscribers, has a potential attacker population.
What does an attacker need to exploit this issue?
The attacker needs an authenticated account with minimal permissions, such as a subscriber account. No additional capability check or nonce validation is enforced by the affected bulk-deletion routine.
What is the impact of successful exploitation?
An attacker can permanently delete all comments on the site through the vulnerable bulk comment-deletion routine.
How can I determine whether my site is affected?
Check whether WP Comment Cleaner is installed and whether its version is earlier than 7.2. Also review whether untrusted or low-privileged users can obtain authenticated accounts on the site.