CVE-2026-75018: Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccffield post meta onto any post regardless of ownership or post type. The top-level form ID is checked via editpost/publishposts, but the nested fields[].ID and choices[].ID paths processed by createandmapfields() and createandmapchoices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while deleteitem() and deletesubmission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. The affected nested field and choice ID paths do not enforce equivalent capability, ownership, or post-type checks.
What can an attacker delete or modify?
An attacker can permanently force-delete arbitrary posts of any post type, including pages, posts authored by administrators, and WooCommerce products. They can also add arbitrary post meta keys beginning with ccf_field_ to any post regardless of ownership or post type.
Is an unauthenticated attacker able to exploit this vulnerability?
No. The supplied severity vector and description indicate that authentication and at least Contributor-level privileges are required; no user interaction is required.
What versions are affected?
All Custom Contact Forms versions up to and including 7.16 are affected. The provided data does not identify a fixed version.