CVE-2026-96532

HighCVSS 7.5

Published: 26/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form. This allows unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

Risk Assessment

An attacker can take control of site content by modifying or deleting existing posts, potentially leading to defacement or injection of malicious content.

Recommendation

Update the plugin to the latest version. Additionally, implement proper capability and ownership checks in the testimonial submission form.

Other vulnerabilities in Testimonials Widget

CVE-2026-96533Medium
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file. This allows unauthenticated users to make the server issue requests to internal services and read the responses.

Original NVD description (English source)

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS