Nelio Content CVE-2026-94505

Exploitation requires an authenticated account with contributor-level capability or higher on a site running Nelio Content ≤4.5.0 - this is the key limiting factor, so the flaw is not exploitable by anonymous internet attackers. No special plugin configuration is needed beyond the plugin being active with its reusable social message (nc_reusable_social) feature in normal use; the vulnerable reusable-message REST controller fails to check ownership/capability before deletion. Realistic risk is therefore concentrated on multi-author or membership sites that grant contributor accounts to lower-trust users.

This is a moderate-priority issue rather than a top-tier emergency, despite its 8.1 'High' CVSS rating. The CVSS vector (AV:N/AC:L/PR:L/UI:N) correctly reflects a remotely reachable REST API endpoint exploitable with low complexity and no user interaction, but PR:L is the critical limiter: an attacker must already hold a valid contributor-level account on the target site. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the finding is a static source-code audit by Wordfence, not an observed attack. I also assess the input's C:N/I:H/A:H impact rating as overstated: the flaw only permits permanent deletion of one specific post type (nc_reusable_social reusable social messages), which is a scoped data-destruction/availability issue rather than a full-integrity compromise of the site, so my independent scoring lands lower (medium). The dominant real-world risk driver is therefore insider or low-trust-tenant abuse on multi-author sites, not mass internet-wide exploitation.

On a multi-author WordPress site running Nelio Content ≤4.5.0, a user holding only contributor-level access (or a contributor account compromised via credential stuffing) sends a crafted request to the plugin's reusable-message REST controller. Because the controller does not verify ownership or capability before deletion, the attacker permanently removes reusable social messages created by administrators or editors, destroying scheduled/auto-posting content. No public POC was provided, and the attack is network-reachable with low complexity but requires valid authentication.