WordPress Plugin Vulnerabilities

Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update

Description

The plugin does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

Proof of Concept

Affects Plugins

Plugin icon
testimonials-widget
No known fix

References

CVE
CVE-2026-96532

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Naiches
Submitter
Naiches
Submitter website
https://naiche.nl
Verified
Yes
WPVDB ID
d1372d8a-6654-4da7-a07e-87b18a0b0db9

Timeline

Publicly Published
2026-09-24 (about 2 days ago)
Added
2026-09-24 (about 1 day ago)
Last Updated
2026-09-25 (about 8 hours ago)

Other

Published
Title
Published
2025-02-12
Title
Pallet Packaging for WooCommerce < 1.1.16 - Missing Authorization
Published
2024-07-22
Title
Icegram < 3.1.25 - Missing Authorization to Unauthenticated Message Duplication
Published
2025-11-21
Title
GSheetConnector For Ninja Forms < 2.0.2 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure
Published
2026-02-04
Title
ELEX WordPress HelpDesk & Customer Ticketing System < 3.3.6 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Published
2025-01-24
Title
GoHero Store Customizer for WooCommerce < 4.0 - Missing Authorization to Unuthenticated Settings Update