What is the CVSS score of EUVD-2026-53187?

EUVD-2026-53187 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Xpro Addons EUVD-2026-53187

| CVE-2026-7105 MEDIUM

Missing Authorization (CWE-862)

2026-08-05 Wordfence

GHSA-9mjp-jh35-6vjg

WordPress Authentication Bypass Xpro Addons 140 Widgets For Elementor Wordpress Plugin Xpro

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible WordPress AJAX endpoint requires only subscriber-level authentication (PR:L); impact is limited to low integrity (post creation) with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 08:06 vuln.today

CVE Published

Aug 05, 2026 - 06:38 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the get_menu_content_editor() function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the xpro_content custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution.

AnalysisAI

Unauthorized post creation in Xpro Addons - 140+ Widgets for Elementor (WordPress) affects all versions through 1.5.1, allowing any authenticated user with Subscriber-level access to publish arbitrary posts of the custom type xpro_content via a missing capability check on the get_menu_content_editor() AJAX handler. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam campaigns, and database pollution against any WordPress site running the plugin. No public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication barrier (any registered user) lowers the practical difficulty of abuse.

Technical ContextAI

The vulnerability is rooted in CWE-862 (Missing Authorization) within the WordPress plugin architecture. The affected function get_menu_content_editor(), located in class-ajax-handler.php (lines 45, 64, and 137 of the 1.5.1 tag), registers a WordPress AJAX action without performing a capability check - the standard WordPress mechanism (current_user_can()) that restricts privileged operations to appropriate roles. Because no nonce verification or role gate is enforced, any user authenticated to WordPress, including the lowest-privilege Subscriber role, can invoke this handler to insert a fully published post of the custom post type xpro_content with an attacker-controlled title. The CPE string cpe:2.3:a:xpro:xpro_addons_-_140+_widgets_for_elementor:*:*:*:*:*:*:*:* with a wildcard version confirms all releases in the 1.x line are affected through 1.5.1.

RemediationAI

An upstream fix has been committed to the plugin trunk (WordPress SVN changeset 3519528, diffed against 3492377 at plugins.trac.wordpress.org/changeset), indicating the vulnerability is addressed in the development branch; however, a specific patched release version beyond 1.5.1 has not been independently confirmed from the available data - users should monitor the WordPress plugin repository for the next release and update promptly. As a compensating control prior to patching, site administrators can disable the plugin entirely if Elementor template menu functionality is not actively required, eliminating the vulnerable AJAX surface. If disabling is not acceptable, restricting WordPress user registration (Settings > General > uncheck 'Anyone can register') prevents anonymous attackers from self-provisioning Subscriber accounts, raising the practical bar for exploitation. Administrators should also audit existing xpro_content post type entries in the database for unexpected or spam content created prior to remediation.