What is the CVSS score of CVE-2026-1935?

CVE-2026-1935 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1935?

Organizations using plugin for WordPress is vulnerable to Missing Authorization in all should be aware of moderate risk from CVE-2026-1935, a missing authorization vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2026-1935?

Within 30 days: Identify affected systems running plugin for WordPress is vulnerable to Missing Authorization and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-1935

EUVD-2026-13988 MEDIUM

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-jxrp-m8r2-xf97

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13988

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 4.3

DescriptionCVE.org

The Company Posts for LinkedIn plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.0. This is due to a missing capability check on the linkedin_company_post_reset_handler() function hooked to admin_post_reset_linkedin_company_post. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete LinkedIn post data stored in the site's options table.

AnalysisAI

The Company Posts for LinkedIn WordPress plugin (versions up to 1.0.0) contains a missing authorization vulnerability in the linkedin_company_post_reset_handler() function that allows authenticated attackers with Subscriber-level privileges to delete LinkedIn post data from the site's options table without proper capability checks. This is a privilege escalation flaw where low-privileged users can perform administrative actions. While the CVSS score is moderate at 4.3 and reflects limited integrity impact without confidentiality or availability concerns, the vulnerability enables unauthorized modification of site configuration data by any authenticated user.

Technical ContextAI

The vulnerability exists in the WordPress plugin architecture where admin-post actions are improperly protected. The affected plugin (cpe:2.3:a:brainstation23:company_posts_for_linkedin:*:*:*:*:*:*:*:*) registers a handler to the admin_post_reset_linkedin_company_post action without implementing WordPress capability checks (such as current_user_can() with appropriate administrator or manage_options capabilities). This represents a CWE-862 (Missing Authorization) vulnerability class where access control validation is completely absent. The plugin hooks directly into WordPress's admin-post action system which, by design, fires for both authenticated and unauthenticated requests, making the missing check particularly dangerous since any logged-in user—even with minimal Subscriber role—can trigger destructive operations on site options.

RemediationAI

Update the Company Posts for LinkedIn plugin to a version beyond 1.0.0 that includes proper capability checks (the plugin vendor should release a patched version implementing current_user_can('manage_options') or appropriate equivalent checks on the linkedin_company_post_reset_handler() function). If immediate patching is unavailable, disable the plugin entirely until a security update is released, as there are limited server-side workarounds for application-level authorization flaws. Additionally, enforce principle of least privilege by restricting WordPress user registration to trusted administrators and regularly audit user roles to ensure Subscriber-level accounts are not unnecessarily granted to untrusted parties. Monitor the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4c635405-997e-44ea-8851-7d09051307ad?source=cve for patch availability notifications.