CVE-2026-4431: Easy Post Submission <= 2.3.0 - Missing Authorization
The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost() function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via wpajaxnoprivrbsmsubmitpost without any authorization checks when a postId parameter is supplied. This makes it possible for unauthenticated attackers to modify the title, content, excerpt, categories, and tags of arbitrary posts, as well as change the post status to draft (effectively unpublishing them) via the 'postId' parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Easy Post Submissionto a version that resolves this vulnerability.Fixed in 2.3.0 - Configuration
Update the plugin so the rbsm_submit_post AJAX handler used by unauthenticated users (wp_ajax_nopriv_rbsm_submit_post) does not register without authorization checks; ensure create_post() performs capability checks before allowing modification of a post when the postId parameter is provided.
WordPress Easy Post Submission plugin rbsm_submit_post authorization for unauthenticated users (wp_ajax_nopriv_rbsm_submit_post) = remove/disable unauthenticated registration or add capability check for create_post() when postId is supplied
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4431?
CVE-2026-4431 has a critical severity rating of 9.1.
How do I fix CVE-2026-4431?
To fix CVE-2026-4431, update the Easy Post Submission plugin to the latest version that includes the necessary authorization checks.
What is the risk associated with CVE-2026-4431?
CVE-2026-4431 poses a risk level of 66, indicating potential unauthorized data modification.
Who is affected by CVE-2026-4431?
All users of the Easy Post Submission plugin for WordPress, versions 2.3.0 and earlier, are affected by CVE-2026-4431.
What are the consequences of CVE-2026-4431?
Exploitation of CVE-2026-4431 could allow unauthorized users to modify posts without proper authorization.