CVE-2026-4431
CRITICAL
CVSS 9.1
Easy Post Submission Frontend Posting Guest Publishing Submit Content For Wordpress
Verified Advisory
Missing authorization in Easy Post Submission plugin for WordPress (CVE-2026-4431)
WordPress
Authentication Bypass
Wordpress Plugin
Easy Post Submission Frontend Posting Guest Publishing Submit Content For Wordpress
The Easy Post Submission plugin for WordPress contains a missing capability check on the `create_post()` function. The `rbsm_submit_post` AJAX action is registered for unauthenticated users via `wp_ajax_nopriv_rbsm_submit_post` without authorization checks when a `postId` parameter is supplied, allowing unauthenticated attackers to modify the title, content, excerpt, categories, and tags of arbitrary posts, or change their status to draft, effectively unpublishing them.
Affected versions:
- <= 2.3.0
We recommend updating to: 2.4.0.
CVSS 9.1 · our assessment: act_now
Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/15494ccf-7c9d-4566-9e80-2da94172a3dd?source=cve
Details: https://vuln.today/cve/CVE-2026-4431
Verified by vuln.today against published advisories.
Affected versions
- – <= 2.3.0
Fixed in: 2.4.0