CVE-2026-1786

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1786", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-03T00:06:18.901Z", "datePublished": "2026-02-11T08:26:27.178Z", "dateUpdated": "2026-04-08T17:14:42.685Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:42.685Z"}, "affected": [{"vendor": "badbreze", "product": "Twitter posts to Blog", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.11.25", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' function in all versions up to, and including, 1.11.25. This makes it possible for unauthenticated attackers to update plugin settings including Twitter API credentials, post author, post status, and the capability required to access the plugin's admin menu."}], "title": "Twitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/abcbb84c-6c2d-40c1-8c64-7d4866fa9503?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/twitter-posts-to-blog/trunk/functions.php#L426"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2026-02-10T20:03:18.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:41:18.886703Z", "id": "CVE-2026-1786", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:44:37.388Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1786", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:41:18.886703Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:41:19.583Z"}}], "cna": {"title": "Twitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "badbreze", "product": "Twitter posts to Blog", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.11.25"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-10T20:03:18.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/abcbb84c-6c2d-40c1-8c64-7d4866fa9503?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/twitter-posts-to-blog/trunk/functions.php#L426"}], "descriptions": [{"lang": "en", "value": "The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' function in all versions up to, and including, 1.11.25. This makes it possible for unauthenticated attackers to update plugin settings including Twitter API credentials, post author, post status, and the capability required to access the plugin's admin menu."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:42.685Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1786", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:42.685Z", "dateReserved": "2026-02-03T00:06:18.901Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-11T08:26:27.178Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Twitter posts to Blog", "vendor": "badbreze", "versions": [{"lessThanOrEqual": "1.11.25", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' function in all versions up to, and including, 1.11.25. This makes it possible for unauthenticated attackers to update plugin settings including Twitter API credentials, post author, post status, and the capability required to access the plugin's admin menu."}, {"lang": "es", "value": "El plugin Twitter posts to Blog para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n dg_tw_options en todas las versiones hasta la 1.11.25, inclusive. Esto hace posible que atacantes no autenticados actualicen la configuraci\u00f3n del plugin, incluyendo las credenciales de la API de Twitter, el autor de la publicaci\u00f3n, el estado de la publicaci\u00f3n y la capacidad requerida para acceder al men\u00fa de administraci\u00f3n del plugin."}], "id": "CVE-2026-1786", "lastModified": "2026-06-17T10:16:31.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1786", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T15:41:18.886703Z", "version": "2.0.3"}}]}, "published": "2026-02-11T09:15:51.690", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/twitter-posts-to-blog/trunk/functions.php#L426"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/abcbb84c-6c2d-40c1-8c64-7d4866fa9503?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.11.25]"}}], "product": "twitter_posts_to_blog", "vendor": "badbreze"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:19:12.693202+00:00", "value": {"mitigation_remediation": ["Upgrade the Twitter posts to Blog plugin to the latest released version that includes an authorization check for the dg_tw_options function.", "Remove or disable the plugin if it is not required for site functionality, as it no longer receives security updates.", "If immediate removal is not possible, restrict write permissions to the plugin options table and block unauthenticated access to the WordPress admin area, ensuring that only users with the correct capabilities can send requests to dg_tw_options."], "summary": {"action": "Patch", "impact": "Unauthorized plugin settings modification"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the badbreze Twitter posts to Blog WordPress plugin up to and including version\u202f1.11.25. The affected product is the WordPress plugin \u201cTwitter posts to Blog\u201d provided by the vendor badbreze. No specific operating system or WordPress core version is required; the flaw exists solely inside the plugin code.", "description_and_impact": "The Twitter posts to Blog plugin for WordPress contains a missing capability check in its 'dg_tw_options' function. As a result, anyone who can reach the plugin\u2019s admin page can modify its configuration data without authentication. The exploitable settings include Twitter API credentials, default post author, post status and the required capability to open the plugin\u2019s admin menu. An attacker who succeeds can create posts that appear to come from legitimate accounts, change the author to that of an authorized user, or provoke the plugin to post malicious content to the blog. Because the settings are stored in the database, this vulnerability endangers confidentiality, integrity, and availability of posts and credentials.", "risk_and_exploitability": "The CVSS vector indicates a moderate severity (score\u202f6.5). The EPSS score of less than\u202f1\u202f% suggests that exploitation is unlikely at the current time, and the flaw is not listed in the CISA KEV catalog. Nevertheless, the lack of an authorization check means that the exploit can be performed over the web by harvesting the plugin\u2019s URL or by sending a crafted POST request. No authentication is required, so any user that can access the WordPress site could, in theory, apply the change. The potential for defacement or credential theft\u2014particularly if the attacker injects compromised Twitter API keys\u2014makes the risk significant for sites that rely on the plugin for automated posting."}}}}, "created": "2026-02-11T21:46:00.442480+00:00", "updated": "2026-04-15T17:30:10.486785+00:00", "vendors": ["badbreze", "badbreze$PRODUCT$twitter_posts_to_blog", "wordpress", "wordpress$PRODUCT$wordpress"]}