CVE-2026-12094 describes a missing authorization vulnerability (CWE-862) in the Advanced Contact Form 7 - Compact DB plugin for WordPress, affecting versions up to and including 1.0.0. The vulnerability arises because the AJAX handler cf7cdb_ajax_delete_user() is registered for both authenticated and unauthenticated users (wp_ajax_cf7cdb_delete and wp_ajax_nopriv_cf7cdb_delete) without performing nonce verification, capability checks, or ownership validation. This allows unauthenticated attackers to invoke $wpdb->delete() on the wp_cf7cdb_data table with an attacker-controlled integer ID, enabling deletion of arbitrary contact form submission records.

The vulnerability allows unauthenticated attackers to delete arbitrary data entries stored by the plugin, specifically contact form submission records. There is no impact on confidentiality or availability reported. The integrity of stored contact form data is compromised due to unauthorized deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints if possible and monitor for suspicious deletion activity. Implementing nonce verification, capability checks, and ownership validation in the cf7cdb_ajax_delete_user() function is necessary to remediate this issue.