CVE-2026-94505
HighCVSS 8.1Summary
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 due to improper verification of user permissions. This allows authenticated attackers with contributor-level access and above to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
Risk Assessment
Organizations may lose important social content, impacting publication planning and marketing campaigns. Attackers may also delete other users' messages, potentially disrupting team workflows.
Recommendation
Update the Nelio Content plugin to a patched version if available. As a temporary measure, restrict contributor permissions and monitor post deletion activity.
Other vulnerabilities in Nelio Content
See all- CVE-2026-57648Medium
The Nelio Content plugin for WordPress versions 4.3.4 and earlier contains a broken access control vulnerability for contributors. A user with the contributor role can gain unauthorized access to functions or data they should not have permissions for.
- CVE-2026-39521Medium
Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content allows Server Side Request Forgery. This issue affects Nelio Content from n/a through <= 4.3.1.
Original NVD description (English source)
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS