Easy Post Submission Frontend Posting Guest Publishing Submit Content For Wordpress
Monthly
Unauthorized data modification in the Easy Post Submission plugin for WordPress (all versions through 2.3.0) lets unauthenticated attackers overwrite the title, content, excerpt, categories, tags, and publication status of any existing post by supplying its postId to a public AJAX endpoint. Because the rbsm_submit_post action is registered for logged-out users with no capability check, an anonymous request can silently rewrite or unpublish arbitrary site content, an integrity- and content-availability-focused flaw scored CVSS 9.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data modification in the Easy Post Submission plugin for WordPress (all versions through 2.3.0) lets unauthenticated attackers overwrite the title, content, excerpt, categories, tags, and publication status of any existing post by supplying its postId to a public AJAX endpoint. Because the rbsm_submit_post action is registered for logged-out users with no capability check, an anonymous request can silently rewrite or unpublish arbitrary site content, an integrity- and content-availability-focused flaw scored CVSS 9.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.