Strong Testimonials EUVD-2026-102228

Exploitation requires an existing authenticated account on the target site (CVSS PR:L), so the realistic prerequisite is either open/self-service user registration or an already-compromised low-privilege credential; the attacker then invokes a Strong Testimonials plugin function whose access-control (capability/authorization) check is missing or misconfigured. Limiting factors: it is not unauthenticated (a valid session is needed), impact is confined to limited confidentiality (C:L, I:N, A:N), and only Strong Testimonials versions up to and including 3.3.12 are affected. The exact vulnerable feature/endpoint is not specified in the description, so defenders should restrict account registration and update the plugin.

This is a low-to-moderate priority issue despite being network-accessible. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 Medium) shows a remotely reachable, low-complexity flaw requiring low privileges (PR:L), with only limited confidentiality impact and no integrity or availability impact - consistent with a CWE-862 Missing Authorization/broken access control weakness that lets an authenticated low-privilege user reach data or a function they should not. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no evidence of active exploitation or weaponization. The signals are internally consistent: a modest-severity authorization gap reported by Patchstack rather than an unauthenticated RCE. The main caveat is that PR:L requires an attacker to already hold a valid (even minimal, e.g. subscriber-level) account on the target WordPress site, which materially limits opportunistic exploitation. Treat this as routine-patch priority, elevated only on sites that allow open user registration.

An attacker registers or already controls a low-privilege account (e.g. subscriber) on a WordPress site running Strong Testimonials ≤ 3.3.12, then sends a crafted request to a plugin endpoint that fails to verify the caller's authorization, exposing testimonial-related data or actions intended for higher-privileged roles. No public exploit code was identified in the provided data, and exploitation yields only limited confidentiality impact.