CVE-2026-107791: medium-severity vulnerability in WP Comment Cleaner
WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.5epss 0.1%
exploitation probability
0.1%top 97% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · WP Comment Cleanerpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/138aae16-6f2c-4477-9518-f120a61577d1/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.