Executive brief
The Testimonials Widget WordPress plugin through version 4.0.4 contains an authorization flaw that allows unauthenticated users to modify or create blog posts on the affected website. An attacker can change post titles, content, and author information for any existing post without logging in, potentially compromising site integrity and enabling defacement or malicious content injection.
Technical details
The plugin's front-end testimonial submission form fails to validate user capabilities or ownership before processing post modifications. An unauthenticated attacker can craft requests to the form handler to create new posts or overwrite existing posts without authentication or authorization checks. The vulnerability is a classic missing authorization control (CWE-862) that can be exploited over the network.
Affected products
- Testimonials Widget through 4.0.4
Timeline
- 2026-09-24: disclosed: Publicly published