Insufficient Input Validation in Testimonials Widget Plugin Affects WordPress
CVE-2026-96532
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 26 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-96532?
The Testimonials Widget plugin for WordPress versions up to 4.0.4 is susceptible to an input validation vulnerability that permits unauthorized users to create and modify posts through the front-end testimonial submission form. This flaw arises from the absence of appropriate capability or ownership checks, enabling attackers to overwrite titles, content, and authors of existing posts without needing authentication.
Affected Version(s)
Testimonials Widget 0 <= 4.0.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.