What is the CVSS score of CVE-2026-4431?

CVE-2026-4431 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Easy Post Submission are affected by CVE-2026-4431?

Any WordPress site running Easy Post Submission plugin is exposed to content tampering by anonymous attackers with no technical barriers to exploitation.

How to fix or mitigate CVE-2026-4431?

Within 24 hours: Disable the Easy Post Submission plugin in WordPress and review access logs for suspicious AJAX traffic to the rbsm_submit_post endpoint; restore any tampered posts from backup if evidence of unauthorized changes is found. Within 7 days: Conduct a comprehensive audit of post metadata (titles, content, publication status, categories) across the site against backups; if the plugin is necessary for business operations, deploy a Web Application Firewall rule to block unauthenticated requests to wp-admin/admin-ajax.php containing the rbsm_submit_post action. Within 30 days: Identify and implement an alternative approved plugin with equivalent functionality, fully remove Easy Post Submission from all installations and code repositories, and establish ongoing monitoring for AJAX endpoints lacking proper capability checks across all installed plugins.

Easy Post Submission CVE-2026-4431

EUVD-2026-53285 CRITICAL

Missing Authorization (CWE-862)

2026-08-05 Wordfence

GHSA-hqvx-hxrc-x42r

WordPress Authentication Bypass Wordpress Plugin Easy Post Submission Frontend Posting Guest Publishing Submit Content For Wordpress

9.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated nopriv AJAX endpoint gives AV:N/AC:L/PR:N/UI:N; arbitrary post rewrite is I:H and unpublishing is content-availability A:H, with no data read so C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 08:38 vuln.today

CVE Published

Aug 05, 2026 - 07:39 nvd

CRITICAL 9.1

DescriptionCVE.org

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_post() function in all versions up to, and including, 2.3.0. This is due to the rbsm_submit_post AJAX action being registered for unauthenticated users via wp_ajax_nopriv_rbsm_submit_post without any authorization checks when a postId parameter is supplied. This makes it possible for unauthenticated attackers to modify the title, content, excerpt, categories, and tags of arbitrary posts, as well as change the post status to draft (effectively unpublishing them) via the 'postId' parameter.

Articles & Coverage 1

News Critical Unauthorized Post Modification in WordPress Easy Post Submission - CVE-2026-4431 Aug 06, 2026

AnalysisAI

Unauthorized data modification in the Easy Post Submission plugin for WordPress (all versions through 2.3.0) lets unauthenticated attackers overwrite the title, content, excerpt, categories, tags, and publication status of any existing post by supplying its postId to a public AJAX endpoint. Because the rbsm_submit_post action is registered for logged-out users with no capability check, an anonymous request can silently rewrite or unpublish arbitrary site content, an integrity- and content-availability-focused flaw scored CVSS 9.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin (CPE cpe:2.3:a:themeruby:easy_post_submission...) providing frontend/guest post submission. WordPress AJAX handlers are hooked via wp_ajax_{action} (authenticated) and wp_ajax_nopriv_{action} (unauthenticated) callbacks. Here the create_post() logic behind the rbsm_submit_post action is bound to wp_ajax_nopriv_rbsm_submit_post, exposing it to anonymous users, and the handler never verifies the caller's capabilities (e.g., edit_post/edit_others_posts) or a valid nonce before acting on a caller-supplied postId. This is a textbook CWE-862 (Missing Authorization): a privileged, state-changing operation is reachable without any authorization gate, so submission logic intended for new content creation can instead be steered onto arbitrary existing post IDs.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the WordPress.org changeset 3488045 (superseding 3427523) at https://plugins.trac.wordpress.org/changeset?new=3488045%40easy-post-submission%2Ftrunk addresses the missing authorization, so update Easy Post Submission to the latest release above 2.3.0 as soon as it is available and verify the installed version in your plugin list. Until a tagged fixed release is confirmed installed, apply compensating controls: deactivate the Easy Post Submission plugin if frontend submission is not essential (trade-off: guest/front-end post submission stops working), or block/deny unauthenticated POST requests to /wp-admin/admin-ajax.php carrying action=rbsm_submit_post at a WAF or reverse proxy (trade-off: may break legitimate anonymous submissions if that workflow is in use). Also review recent post revisions and restore any content that was altered or set to draft, and consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/15494ccf-7c9d-4566-9e80-2da94172a3dd) for detection signatures.