WordPress Plugin Vulnerabilities

Fusion Page Builder < 1.7.1 - Contributor+ Arbitrary Post Trashing via IDOR

Description

The plugin does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash is disabled.

Proof of Concept

Affects Plugins

Plugin icon
fusion
Fixed in 1.7.1

References

CVE
CVE-2026-121759

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.9 (medium)

Miscellaneous

Original Researcher
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
df86f132-208c-4ba4-bf90-cc59b123f610

Timeline

Publicly Published
2026-11-06 (about 3 days ago)
Added
2026-11-06 (about 2 days ago)
Last Updated
2026-11-06 (about 2 days ago)

Other

Published
Title
Published
2024-11-20
Title
If-So Dynamic Content Personalization < 1.9.2.2 - Authenticated (Contributor+) Post Disclosure
Published
2026-10-02
Title
Issues and Series for Newspapers, Magazines, Publishers, Writers < 3.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference
Published
2024-08-26
Title
Timetics < 1.0.24 - Authorization Bypass
Published
2026-08-04
Title
Groundhogg — CRM, Newsletters, and Marketing Automation < 4.5.3 - Insecure Direct Object Reference
Published
2026-09-24
Title
GiveWP – Donation Plugin and Fundraising Platform < 4.17.0 - Unauthenticated Insecure Direct Object Reference