6.5
Medium
CVE-2026-107791 The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of…
Description
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Comment Cleaner 6.1 | 6.1 → < 7.2 | 7.2 |