Strong Testimonials EUVD-2026-102242

Exploitation requires an existing authenticated WordPress account with at least low-privilege access (CVSS PR:L) on a site running Strong Testimonials up to and including version 3.3.12; no user interaction is needed (UI:N) and the vector is network-reachable (AV:N). The limiting factor is the authentication requirement - the attacker must be able to register or obtain a low-privilege account, so sites that disable open user registration substantially reduce exposure. Impact is confined to limited integrity and availability effects on plugin-managed testimonial functionality (C:N), not full site compromise or data disclosure.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the WP Chill Strong Testimonials WordPress plugin, rated CVSS 5.4 via CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The CVSS vector indicates network-reachable, low-complexity exploitation that requires some level of authenticated access (PR:L) and no user interaction, with no confidentiality impact but limited integrity and availability impact. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public proof-of-concept was referenced - so there is no public exploit identified at time of analysis. The 'Authentication Bypass' tag conflicts somewhat with the CVSS PR:L metric, which indicates the attacker must already hold a low-privilege account rather than bypassing authentication entirely; this is more accurately a broken access control / authorization gap where a low-privileged user can reach functionality intended for higher roles. Overall this is a real but non-urgent issue: the low privilege requirement, absence of confidentiality impact, lack of KEV/POC signals, and the 'medium' real-world footprint place it as a patch-in-normal-cycle item rather than an emergency, though exposure rises on sites that freely grant subscriber/contributor accounts.

An attacker who holds a low-privilege WordPress account (e.g., subscriber or contributor) on a site running Strong Testimonials ≤ 3.3.12 sends a crafted request to a plugin endpoint that lacks a proper capability or authorization check. Because of the missing authorization, the attacker performs an action reserved for higher-privileged users, modifying or disrupting testimonial-related data (limited integrity and availability impact). No public exploit code was identified, and the low attack complexity means exploitation is straightforward once authenticated.