Description

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-26T07:17:03.527Z",
  "pubdate": "2026-09-26T07:17:03.527Z",
  "executiveSummary": "The Testimonials Widget WordPress plugin, in versions up to and including 4.0.4, contains a critical security vulnerability involving improper authorization for front-end post submission.\nThe vulnerability is categorized as an insecure direct object reference and missing access control, allowing unauthenticated remote attackers to bypass security checks.\nBy manipulating the front-end submission mechanism, an attacker can create new arbitrary posts or modify existing content within the WordPress database.\nThis impact extends to the ability to overwrite the title, body content, and author metadata of any existing post, potentially leading to unauthorized data modification, site defacement, or the injection of malicious content into legitimate pages.\nBecause the vulnerability requires no authentication or administrative privileges, it poses a high risk to the integrity of the affected WordPress site, enabling attackers to perform unauthorized administrative-level post management via the public-facing interface.",
  "technicalDetails": "The vulnerability resides in the front-end testimonial submission processing logic of the Testimonials Widget plugin. The root cause is a complete lack of authorization checks (capability checks) and ownership validation within the function responsible for handling form submissions.\nIn WordPress development, sensitive actions such as post creation or modification must be gated by permission checks, typically implemented using current_user_can() to verify user roles or capabilities, and nonce verification to ensure the integrity of the request source.\nIn this specific instance, the plugin's submission handler fails to verify the requestor's identity or permissions before executing the database write operation. Consequently, the input is processed indiscriminately regardless of the user's authentication status.\nThe attack flow begins when an attacker identifies the endpoint associated with the Testimonials Widget submission form. By crafting a custom HTTP POST request that mimics the expected form structure, an attacker can interact directly with the vulnerable backend logic.\nBecause the plugin does not implement nonce validation, the request is not bound to a specific user session or form instance, rendering the submission susceptible to automated exploitation and cross-site request forgery (CSRF) vectors.\nAn attacker can supply specific POST parameters to the handler, which then utilizes standard WordPress functions like wp_insert_post() or wp_update_post() without restricting the scope of these actions. By injecting a post ID into the payload, the attacker can force the application to overwrite existing posts.\nThis allows the attacker to alter the title, post content, and author fields of any post currently present in the database, including pages and posts intended for administrative management.\nThe vulnerability is exposed via the network to any unauthenticated user capable of accessing the site's front-end. The post-exploitation impact is severe, as it grants unauthorized remote users the ability to perform persistent modifications to the site's content, potentially leading to the dissemination of malicious scripts, phishing content, or structural damage to the site's organizational integrity."
}