Nelio Content Editorial Calendar Social Media Auto Posting
Monthly
Nelio Content 4.5.0 and earlier for WordPress fails to verify authorization in its reusable-message REST controller, allowing authenticated users with contributor-level access or higher to permanently delete any nc_reusable_social post, including reusable social messages authored by administrators or other privileged users. Exploitation requires an authenticated contributor account on a site running the plugin with its reusable social message feature active, so anonymous internet attackers cannot trigger it. No public exploit identified at time of analysis; the independent assessment rates this as a moderate-priority issue rather than a top-tier emergency, despite the original 8.1 High CVSS rating, because impact is limited to reusable social messages and requires contributor-level access.
Nelio Content 4.5.0 and earlier for WordPress fails to verify authorization in its reusable-message REST controller, allowing authenticated users with contributor-level access or higher to permanently delete any nc_reusable_social post, including reusable social messages authored by administrators or other privileged users. Exploitation requires an authenticated contributor account on a site running the plugin with its reusable social message feature active, so anonymous internet attackers cannot trigger it. No public exploit identified at time of analysis; the independent assessment rates this as a moderate-priority issue rather than a top-tier emergency, despite the original 8.1 High CVSS rating, because impact is limited to reusable social messages and requires contributor-level access.