CVE-2025-62062

MediumCVSS 5.5

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The ThemeRuby Easy Post Submission plugin (easy-post-submission) up to version 1.7.0 has a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data.

Risk Assessment

An attacker can access sensitive data such as credentials or personal information, potentially leading to privacy and security breaches for users.

Recommendation

It is recommended to update the Easy Post Submission plugin to the latest version that includes a fix for the sensitive information leak.

Other vulnerabilities in Easy Post Submission

CVE-2026-4431Critical
The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` function in all versions up to, and including, 2.3.0. This is due to the `rbsm_submit_post` AJAX action being registered for unauthenticated users via `wp_ajax_nopriv_rbsm_submit_post` without any authorization checks when a `postId` parameter is supplied. This makes it possible for unauthenticated attackers to modify the title, content, excerpt, categories, and tags of arbitrary posts, as well as change the post status to draft (effectively unpublishing them) via the 'postId' parameter.

Original NVD description (English source)

Insertion of Sensitive Information Into Sent Data vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Retrieve Embedded Sensitive Data.This issue affects Easy Post Submission: from n/a through <= 1.7.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS