Is CVE-2026-107791 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-107791

Description

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.