CVE-2026-75018: CWE-862 Missing Authorization in outlawgt Custom Contact Forms
Description
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.
CVSS v3.1
Score 4.3medium
Affected software
outlawgt
Custom Contact Forms
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75018 is an authorization bypass vulnerability in the Custom Contact Forms WordPress plugin (outlawgt) affecting all versions up to 7.16. The plugin fails to verify user authorization on nested fields and choices processed by internal functions _create_and_map_fields() and _create_and_map_choices(), allowing authenticated users with contributor-level privileges or higher to permanently delete arbitrary posts of any type and write arbitrary ccf_field_* post meta to any post. While top-level form IDs are checked via edit_post/publish_posts capabilities, the nested data paths lack equivalent capability or post-type restrictions, exposing these sinks. The presence of explicit post-type restrictions in other functions indicates developer awareness but incomplete coverage.
Potential Impact
Authenticated users with contributor-level access or above can bypass authorization controls to delete arbitrary posts permanently and modify post meta data across all post types, including high-privilege content such as administrator-authored posts and WooCommerce products. This can lead to unauthorized content removal and data manipulation within the affected WordPress site. There is no indication of confidentiality or availability impact beyond integrity loss. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a fix is released, restrict contributor-level access and above to trusted users only. Monitor for plugin updates from the vendor and apply official patches once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-08-17T13:16:39.258Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9bca4bacd9273b49863c33
Added to database: 09/05/2026, 07:52:43 UTC
Last enriched: 09/07/2026, 11:24:15 UTC
Last updated: 10/19/2026, 18:48:23 UTC
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.