Comment Cleaner — Bulk Delete & Disable Comments <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Comment Deletion
- ID
- WPSEC-2026-0386
- Plugin
- WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments (delete-all-comments-of-website)
- Affected
- from 6.1 before 7.2
- Remediation
- Update to 7.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Comment Cleaner — Bulk Delete & Disable Comments on WPSec AttackSurface
- Fix released
- Published
Also published later by Another source as CVE-2026-107791, on 2026-10-10.
Description
The WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments plugin for WordPress is vulnerable to unauthorized deletion of comments in versions 6.1 through 6.8 and in version 7.1 (version 7.0 is not affected) due to the nav_delete_all_comment() function being hooked to admin_menu without any capability check or nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete the site's comments (all, approved, pending, spam or trashed) by submitting the 'nav_delete_comment' parameter with a request to any wp-admin page. The missing nonce check also allows the same action to be triggered via Cross-Site Request Forgery if a logged-in user can be tricked into submitting a forged request.
References
- https://wpsec.com/vuln/WPSEC-2026-0386/
- https://plugins.svn.wordpress.org/delete-all-comments-of-website/tags/7.2/
- https://wordpress.org/plugins/delete-all-comments-of-website/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS