CVE-2026-1916

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1916", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-04T15:54:39.204Z", "datePublished": "2026-02-25T08:25:31.051Z", "dateUpdated": "2026-04-08T17:01:22.116Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:22.116Z"}, "affected": [{"vendor": "javmah", "product": "WPGSI: Spreadsheet Integration", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.8.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks and an insecure authentication mechanism on the `wpgsi_callBackFuncAccept` and `wpgsi_callBackFuncUpdate` REST API functions in all versions up to, and including, 3.8.3. Both REST endpoints use `permission_callback => '__return_true'`, allowing unauthenticated access. The plugin's custom token-based validation relies on a Base64-encoded JSON object containing the user ID and email address, but is not cryptographically signed. This makes it possible for unauthenticated attackers to forge tokens using publicly enumerable information (admin user ID and email) to create, modify, and delete arbitrary WordPress posts and pages, granted they know the administrator's email address and an active integration ID with remote updates enabled."}], "title": "WPGSI: Spreadsheet Integration <= 3.8.3 - Missing Authorization to Unauthenticated Arbitrary Post Creation and Deletion via Forged Base64 Token", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7598b38b-26b1-4640-9bd7-60613a5f704d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/tags/3.8.3/admin/class-wpgsi-update.php#L94"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/tags/3.8.3/admin/class-wpgsi-update.php#L116"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/tags/3.8.3/admin/class-wpgsi-update.php#L636"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-update.php#L94"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-update.php#L116"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-update.php#L636"}, {"url": "https://plugins.trac.wordpress.org/changeset/3461326/wpgsi/trunk/admin/class-wpgsi-update.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "timeline": [{"time": "2026-02-04T16:09:49.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-24T19:34:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T16:45:00.950996Z", "id": "CVE-2026-1916", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T16:50:00.569Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1916", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T16:45:00.950996Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T16:49:53.672Z"}}], "cna": {"title": "WPGSI: Spreadsheet Integration <= 3.8.3 - Missing Authorization to Unauthenticated Arbitrary Post Creation and Deletion via Forged Base64 Token", "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "javmah", "product": "WPGSI: Spreadsheet Integration", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.8.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-04T16:09:49.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-24T19:34:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7598b38b-26b1-4640-9bd7-60613a5f704d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/tags/3.8.3/admin/class-wpgsi-update.php#L94"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/tags/3.8.3/admin/class-wpgsi-update.php#L116"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/tags/3.8.3/admin/class-wpgsi-update.php#L636"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-update.php#L94"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-update.php#L116"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-update.php#L636"}, {"url": "https://plugins.trac.wordpress.org/changeset/3461326/wpgsi/trunk/admin/class-wpgsi-update.php"}], "descriptions": [{"lang": "en", "value": "The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks and an insecure authentication mechanism on the `wpgsi_callBackFuncAccept` and `wpgsi_callBackFuncUpdate` REST API functions in all versions up to, and including, 3.8.3. Both REST endpoints use `permission_callback => '__return_true'`, allowing unauthenticated access. The plugin's custom token-based validation relies on a Base64-encoded JSON object containing the user ID and email address, but is not cryptographically signed. This makes it possible for unauthenticated attackers to forge tokens using publicly enumerable information (admin user ID and email) to create, modify, and delete arbitrary WordPress posts and pages, granted they know the administrator's email address and an active integration ID with remote updates enabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:22.116Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1916", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:01:22.116Z", "dateReserved": "2026-02-04T15:54:39.204Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-25T08:25:31.051Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPGSI: Spreadsheet Integration", "vendor": "javmah", "versions": [{"lessThanOrEqual": "3.8.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks and an insecure authentication mechanism on the `wpgsi_callBackFuncAccept` and `wpgsi_callBackFuncUpdate` REST API functions in all versions up to, and including, 3.8.3. Both REST endpoints use `permission_callback => '__return_true'`, allowing unauthenticated access. The plugin's custom token-based validation relies on a Base64-encoded JSON object containing the user ID and email address, but is not cryptographically signed. This makes it possible for unauthenticated attackers to forge tokens using publicly enumerable information (admin user ID and email) to create, modify, and delete arbitrary WordPress posts and pages, granted they know the administrator's email address and an active integration ID with remote updates enabled."}, {"lang": "es", "value": "El plugin WPGSI: Spreadsheet Integration para WordPress es vulnerable a la modificaci\u00f3n no autorizada y la p\u00e9rdida de datos debido a la falta de comprobaciones de capacidad y un mecanismo de autenticaci\u00f3n inseguro en las funciones de la API REST 'wpgsi_callBackFuncAccept' y 'wpgsi_callBackFuncUpdate' en todas las versiones hasta la 3.8.3, inclusive. Ambos puntos finales REST utilizan 'permission_callback =&gt; '__return_true'', lo que permite el acceso no autenticado. La validaci\u00f3n personalizada basada en tokens del plugin se basa en un objeto JSON codificado en Base64 que contiene el ID de usuario y la direcci\u00f3n de correo electr\u00f3nico, pero no est\u00e1 firmado criptogr\u00e1ficamente. Esto hace posible que atacantes no autenticados forjen tokens utilizando informaci\u00f3n p\u00fablicamente enumerable (ID de usuario administrador y correo electr\u00f3nico) para crear, modificar y eliminar publicaciones y p\u00e1ginas arbitrarias de WordPress, siempre que conozcan la direcci\u00f3n de correo electr\u00f3nico del administrador y un ID de integraci\u00f3n activo con las actualizaciones remotas habilitadas."}], "id": "CVE-2026-1916", "lastModified": "2026-06-17T10:16:43.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1916", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T16:45:00.950996Z", "version": "2.0.3"}}]}, "published": "2026-02-25T09:16:14.943", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpgsi/tags/3.8.3/admin/class-wpgsi-update.php#L116"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpgsi/tags/3.8.3/admin/class-wpgsi-update.php#L636"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpgsi/tags/3.8.3/admin/class-wpgsi-update.php#L94"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-update.php#L116"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-update.php#L636"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-update.php#L94"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3461326/wpgsi/trunk/admin/class-wpgsi-update.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7598b38b-26b1-4640-9bd7-60613a5f704d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.8.3]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "WPGSI: Spreadsheet Integration", "source": "cna", "vendor": "javmah"}, "product": "spreadsheet_integration", "vendor": "javmah"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:04:40.807740+00:00", "value": {"mitigation_remediation": ["Upgrade the WPGSI: Spreadsheet Integration plugin to the latest version that implements proper authentication checks and signed tokens, or to any release beyond 3.8.3.", "If an immediate upgrade is not possible, disable or uninstall the plugin entirely to remove exposed REST endpoints until a patch is available.", "Configure the WordPress REST API to enforce capability checks on the plugin\u2019s endpoints, ensuring that only users with appropriate permissions can create, modify, or delete content.", "Additionally, strengthen site security by applying a web application firewall such as Wordfence and monitoring for suspicious REST requests."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Content Manipulation via Arbitrary Post Creation/Deletion"}, "threat_synthesis": {"affected_systems": "All installations of the javmah WPGSI: Spreadsheet Integration plugin up to and including version 3.8.3 are vulnerable. The issue spans the entire WordPress ecosystem wherever this plugin is deployed, affecting sites that allow remote updates through the plugin\u2019s integration feature.", "description_and_impact": "The WPGSI: Spreadsheet Integration plugin for WordPress contains missing authorization checks on two REST API endpoints, allowing any request to execute because the permission callback always returns true. The plug\u2011in uses a Base64\u2011encoded JSON token that carries the user ID and email address without cryptographic signing, making the token easily forgeable. As a result, an unauthenticated attacker who knows an administrator\u2019s email address and an active integration ID can create, modify, or delete arbitrary WordPress posts and pages, severely compromising content integrity and data loss.", "risk_and_exploitability": "The overall risk is moderate to high, with a CVSS 3.1 score of 7.5. The EPSS score is below 1%, indicating a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Because the vulnerability is exploitable via unauthenticated REST API calls, an attacker only needs to identify an admin email and an active integration ID, and then can forge a token to perform arbitrary content operations. The lack of cryptographic signing and missing capability checks make the attack straightforward once the prerequisites are met."}}}}, "created": "2026-02-26T13:18:20.648272+00:00", "updated": "2026-04-15T18:15:10.816139+00:00", "vendors": ["javmah", "javmah$PRODUCT$spreadsheet_integration", "wordpress", "wordpress$PRODUCT$wordpress"]}