EUVD-2026-108033
GHSA-2vvr-jrm3-w4cm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege WordPress account
-
ExploitSend request to unprotected plugin action
-
ExecutionBypass missing authorization check
-
ImpactModify testimonial data without permission
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an existing authenticated low-privilege account on the target WordPress site (CVSS PR:L), since the flaw is a missing authorization check on a Strong Testimonials plugin action rather than a pre-authentication bypass. The affected feature is not named in the description, but the attack is remote (AV:N), needs no user interaction (UI:N), and works against sites running Strong Testimonials versions up to and including 3.3.14. Limiting factors: an attacker must first be able to register or obtain a low-privilege account, impact is confined to integrity (no data disclosure or denial of service), and sites that restrict user registration materially reduce the attack surface. |
| Impact | This is a moderate-severity Missing Authorization flaw (CWE-862) in the WP Chill Strong Testimonials WordPress plugin, with a vendor/Patchstack CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). The vector signals network-reachable, low-complexity exploitation requiring low privileges (PR:L) and no user interaction, but with only limited integrity impact and no confidentiality or availability impact - consistent with an authenticated low-privilege user performing an action they should not be authorized to perform (broken access control). No EPSS probability, CISA KEV listing, SSVC decision data, or POC was provided in the input, so there is no signal of active exploitation or automatable mass abuse. On balance this is a real but low-priority issue: the low integrity-only impact and the PR:L authentication requirement substantially constrain real-world risk, and absent EPSS/KEV/POC data there is no evidence of exploitation in the wild. The input Tag 'Authentication Bypass' conflicts with the CWE-862/Missing Authorization classification and Patchstack's 'Broken Access Control' title - this is an authorization (post-login access control) flaw, not an authentication bypass; treat the tag with caution. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account (e.g., subscriber) on a WordPress site running Strong Testimonials ≤3.3.14 sends a crafted request to a plugin endpoint that fails to verify the user's authorization. Because access control is missing, the attacker performs a privileged testimonial-management action and modifies data they should not be able to touch, yielding limited integrity impact. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Missing authorization (CWE-862) in the WP Chill Strong Testimonials WordPress plugin, affecting versions through 3.3.14, lets a holder of a low-privilege authenticated account invoke a plugin action that never verifies the caller's capabilities, so they can make changes they should not be permitted to make. Because the CVSS vector is PR:L with impact limited to integrity (C:N/I:L/A:N), the practical exposure is unauthorized modification of testimonial-related content rather than data theft or site takedown, and the prerequisite is an existing account on the target site. Rated 4.3 by the vendor/Patchstack, with no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
RemediationAI
No vendor-released patch version is identified in the available data, so the first step is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/strong-testimonials/vulnerability/wordpress-strong-testimonials-plugin-3-3-14-broken-access-control-vulnerability) and the plugin's WordPress.org changelog for a release newer than 3.3.14 and upgrade to it as soon as it is confirmed to contain the authorization fix - until such a release is verified, treat 3.3.14 and below as vulnerable. Because exploitation requires a low-privilege account, the highest-value compensating control is to close the account-acquisition path: disable open user registration (Settings > General > Membership) and remove or downgrade stale Subscriber/Contributor accounts, accepting the trade-off that legitimate self-service sign-ups and community features will stop working. If the plugin's testimonial submission or moderation features are not in active use, deactivating Strong Testimonials removes the attack surface entirely at the cost of losing existing testimonial displays (content is retained in the database). A virtual patch via WAF that restricts POST requests to admin-ajax.php/REST routes carrying the plugin's action parameter to users with appropriate roles can buy time, but such rules are brittle and prone to false positives against legitimate admin activity. Finally, review audit logs for unexpected testimonial creation or modification by low-privilege users, since the flaw permits integrity changes that would appear as ordinary authenticated activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Strong Testimonials is a WordPress plugin that adds testimonial collection, submission and display features to a site, and like most plugins it exposes its administrative actions as WordPress AJAX handlers (admin-ajax.php) or REST routes registered with register_rest_route. CWE-862 (Missing Authorization) means the handler performs an action without ever calling current_user_can() or checking a nonce/capability for the specific operation, relying instead on the mere fact that the request arrives from a logged-in session. In WordPress's permission model, any authenticated user - including a Subscriber - can reach such handlers if they are registered without a capability gate, which is exactly the gap described here for versions up to and including 3.3.14. The attack surface is network-reachable (AV:N), needs no victim interaction (UI:N), and requires only a low-privilege foothold (PR:L), so typical exploit scenarios involve self-registration on sites that allow open sign-ups followed by crafted requests against the plugin's endpoint. No CPE data was supplied, so the affected component is identified by plugin slug (strong-testimonials) and the version ceiling in the vendor advisory rather than by a formal product match string.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Remote, low-complexity action requiring a low-privilege authenticated account (PR:L); missing authorization permits limited unauthorized data modification, so I:L with no confidentiality or availability impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB