A missing capability check in the Easy Post Submission plugin for WordPress lets unauthenticated attackers rewrite or unpublish arbitrary posts on affected sites, earning a CVSS 3.1 score of 9.1 (Critical).
What Is It
CVE-2026-4431 is a missing authorization flaw (CWE-862) in the create_post() function of the Easy Post Submission plugin for WordPress. The plugin registers the rbsm_submit_post AJAX action for unauthenticated users via wp_ajax_nopriv_rbsm_submit_post and performs no authorization checks when a postId parameter is supplied. The result is unauthorized modification of data by anyone who can reach the site.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high integrity and availability impact and no confidentiality impact.
Why It Matters
An unauthenticated attacker can modify the title, content, excerpt, categories, and tags of arbitrary posts; not just their own submissions. They can also flip a post's status to draft, effectively unpublishing it. That combination supports content defacement, injection of attacker-controlled text into trusted pages, and takedown of legitimate content, all without a login.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the wild at this time.
What's Vulnerable
- Vendor: themeruby
- Product: Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress
- Affected versions: all versions up to and including 2.3.0
- Status: published 2026-08-05, NVD
vulnStatusis Received (analysis not yet complete)
Patch Status
The supplied record does not name a fixed version and includes no CISA KEV required action or due date. It does reference a WordPress plugin changeset (trunk revision 3488045, replacing 3427523) associated with the fix. Administrators running 2.3.0 or earlier should treat this as unpatched until a confirmed fixed release is verified, and consider disabling the plugin in the interim.
Sources
- NVD, CVE-2026-4431 record, source
[email protected] - Wordfence Threat Intel: https://www.wordfence.com/threat-intel/vulnerabilities/id/15494ccf-7c9d-4566-9e80-2da94172a3dd?source=cve
- WordPress Plugin Trac; fix changeset: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3488045%40easy-post-submission%2Ftrunk&old=3427523%40easy-post-submission%2Ftrunk
- WordPress Plugin Trac,
client-ajax-handler.phpL38: https://plugins.trac.wordpress.org/browser/easy-post-submission/tags/2.2.0/includes/client-ajax-handler.php#L38 - WordPress Plugin Trac,
client-ajax-handler.phpL974: https://plugins.trac.wordpress.org/browser/easy-post-submission/tags/2.2.0/includes/client-ajax-handler.php#L974 - WordPress Plugin Trac,
client-ajax-handler.phpL1157: https://plugins.trac.wordpress.org/browser/easy-post-submission/tags/2.2.0/includes/client-ajax-handler.php#L1157