CVE-2026-9187 is a missing authorization vulnerability (CWE-862) in the Abandoned Contact Form 7 plugin for WordPress by zealopensource. Versions up to and including 2.2 are affected. The vulnerability exists in the action__remove_abandoned() function, which is registered to both authenticated and unauthenticated AJAX hooks (wp_ajax_remove_abandoned and wp_ajax_nopriv_remove_abandoned). This function accepts a recover_id parameter from POST data and calls wp_delete_post() with force delete enabled, without verifying that the post belongs to the plugin's custom post type or that the request is authorized. Consequently, unauthenticated attackers can delete arbitrary posts or pages permanently by sending a single crafted AJAX request to admin-ajax.php.

An unauthenticated attacker can permanently delete arbitrary posts, pages, or other content on a vulnerable WordPress site running the affected plugin version. This results in integrity loss of site content. There is no confidentiality or availability impact indicated. The CVSS 3.1 base score is 5.3 (medium severity) reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to admin-ajax.php or disable the Abandoned Contact Form 7 plugin if possible. Monitor for updates from zealopensource and apply official patches once released. Avoid exposing the vulnerable AJAX action to unauthenticated users.