CVE-2026-75018 outlawgt CVE debrief

Who should care

WordPress site administrators and security teams should assess exposure and apply patches. Contributors and above roles with access to the Custom Contact Forms plugin should be aware of the potential for exploitation.

Why it matters

The Custom Contact Forms plugin for WordPress has an authorization bypass vulnerability that allows authenticated attackers to delete arbitrary posts and write arbitrary post meta. WordPress site administrators and security teams should assess exposure and apply patches.

• Potential for permanent deletion of arbitrary posts
• Potential for writing arbitrary post meta
• Requires verification of contributor-level access restrictions
• Medium priority for patching due to CVSS score of 4.3

Technical summary

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the Custom Contact Forms plugin is installed and if the version is up to date.
• Verify that contributor-level access and above roles are properly restricted.
• Apply patches or updates to the Custom Contact Forms plugin as soon as possible.
• Monitor for suspicious activity related to post deletion and meta modifications.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is due to improper verification of user authorization in the Custom Contact Forms plugin. The plugin does not properly check if a user is authorized to perform certain actions, allowing attackers to delete arbitrary posts and write arbitrary post meta.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.