CVE-2026-105059 in Delete All Comments of Website Plugin
Summary
by MITRE • 10/06/2026
Subscriber Broken Access Control in Delete All Comments of wordpress <= 7.1 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as CVE-2024-3569 represents a critical broken access control flaw within the WordPress plugin Subscriber, specifically affecting versions up to and including 7.1. This security issue stems from an insufficient authorization check on the server-side endpoint responsible for handling bulk deletion operations of user comments. In a properly secured web application, actions that modify or delete data must verify that the initiating request originates from a user with sufficient privileges relative to the target resource. However, in this implementation, the plugin fails to validate whether the authenticated subscriber possesses the administrative rights required to execute such destructive commands across all comment records associated with the site. This architectural oversight allows any logged-in user, regardless of their assigned role or capability level, to bypass standard permission boundaries and perform actions reserved exclusively for administrators.
From a technical perspective, this vulnerability is classified under CWE-269, which denotes Improper Privilege Control, and aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it involves the misuse of legitimate credentials to gain unauthorized access to functions or data. The exploitation mechanism typically involves an attacker who has obtained valid subscriber-level credentials for a WordPress installation running the vulnerable plugin version. By crafting specific HTTP requests directed at the affected endpoint, often involving POST methods with parameters indicating bulk deletion operations such as delete_all_comments, the attacker can force the application to execute these commands without triggering any privilege escalation errors or access denied responses. The lack of server-side validation means that the application blindly trusts the client's intent regarding administrative actions, leading to a complete breakdown in role-based access control mechanisms.
The operational impact of this vulnerability is severe due to its potential for data integrity compromise and service disruption. An attacker can systematically delete all comments stored within the WordPress database, resulting in significant loss of user-generated content that may hold historical or evidentiary value. Beyond mere deletion, such actions can disrupt community engagement metrics and damage the reputation of the website owner by removing legitimate interactions. Furthermore, if the application logic relies on comment counts for other functionalities, this mass deletion could trigger cascading failures or unexpected behaviors in dependent modules. The ability to perform bulk operations also increases the efficiency of denial-of-service attacks against the database layer, as deleting large volumes of records consumes substantial computational resources and I/O bandwidth, potentially degrading performance for legitimate users even if full data loss is not intended by the attacker.
Mitigation strategies must prioritize immediate remediation through software updates alongside defensive configuration changes. The primary solution is to upgrade the Subscriber plugin to version 7.2 or later, where developers have implemented proper authorization checks ensuring that only users with administrator-level capabilities can execute bulk comment deletion operations. In environments where patching cannot be applied immediately due to compatibility constraints or operational risks, temporary mitigations should include restricting access to administrative endpoints via web application firewall rules and enforcing strict role-based permissions at the server level. Additionally, implementing database backup routines ensures data recovery is possible in case of malicious activity. Continuous monitoring for anomalous deletion patterns can also aid in early detection of exploitation attempts, allowing security teams to respond before significant damage occurs.