—

DRUPAL-CONTRIB-2026-133

Details

This module enables you to delete Webform submissions in bulk using a specified date range.

The module doesn't sufficiently restrict access to the delete form.

A [separate PHP fatal error issue](https://www.drupal.org/project/webform_submissions_delete/issues/3396717) may prevent exploitation in practice on Drupal 10+.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/webform_submissions_delete

Introduced in: 0Fixed in: 1.2.0

Upgrade drupal/webform_submissions_delete to 1.2.0 or newer (ecosystem packagist:https://packages.drupal.org/8).

References

https://www.drupal.org/sa-contrib-2026-133[WEB]