medium6.5
CVE-2026-107791
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowi…
Impact
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
Affected products
| Product | Affected versions |
|---|---|
| WP Comment Cleaner WordPress Plugin | before 7.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.