Unauthorized Data Modification in Easy Post Submission Plugin for WordPress
CVE-2026-4431

9.1CRITICAL

Key Information:

Vendor

WordPress
Status
Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content For WordPress
Vendor
CVE Published:
5 August 2026

What is CVE-2026-4431?

The Easy Post Submission plugin for WordPress is susceptible to unauthorized data modification due to a lack of capability checks on the create_post() function. This vulnerability is triggered when the rbsm_submit_post AJAX action is made available to unauthenticated users via wp_ajax_nopriv_rbsm_submit_post, allowing them to modify post attributes such as title, content, and categories by supplying a postId parameter. Attackers can also change the post’s status to draft, effectively unpublishing the content, thus posing significant risks to website integrity.

Affected Version(s)

Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress 0 <= 2.3.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/easy-post-subm...
https://plugins.trac.wordpress.org/browser/easy-post-subm...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Md. Moniruzzaman Prodhan (NomanProdhan)
.