CVE-2026-57648
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Nelio Content plugin for WordPress versions 4.3.4 and earlier contains a broken access control vulnerability for contributors. A user with the contributor role can gain unauthorized access to functions or data they should not have permissions for.
Risk Assessment
The risk involves potential privilege escalation by contributors, which could lead to unauthorized content modification, post publishing, or access to sensitive data within the WordPress system.
Recommendation
It is recommended to immediately update the Nelio Content plugin to the latest available version that fixes this vulnerability. Also review and adjust user permissions in WordPress.
Other vulnerabilities in Nelio Content
See all- CVE-2026-94505High
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 due to improper verification of user permissions. This allows authenticated attackers with contributor-level access and above to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
- CVE-2026-39521Medium
Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content allows Server Side Request Forgery. This issue affects Nelio Content from n/a through <= 4.3.1.
Original NVD description (English source)
Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS