CVE-2026-2126

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2126", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-06T18:37:48.354Z", "datePublished": "2026-02-18T09:25:51.296Z", "dateUpdated": "2026-04-08T16:32:44.750Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:32:44.750Z"}, "affected": [{"vendor": "specialk", "product": "User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "20260113", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260113. This is due to the `usp_get_submitted_category()` function accepting user-submitted category IDs from the POST body without validating them against the admin-configured allowed categories stored in `usp_options['categories']`. This makes it possible for unauthenticated attackers to assign submitted posts to arbitrary categories, including restricted ones, by crafting a direct POST request with manipulated `user-submitted-category[]` values, bypassing the frontend category restrictions."}], "title": "User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02c5e3ad-5cc3-40b1-a15a-10d53383abe6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.php#L298"}, {"url": "https://plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.php#L1431"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3463696%40user-submitted-posts%2Ftrunk&old=3456521%40user-submitted-posts%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "timeline": [{"time": "2026-02-06T18:53:16.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-17T20:36:12.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T12:26:21.098592Z", "id": "CVE-2026-2126", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:51:09.152Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2126", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T12:26:21.098592Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:26:22.237Z"}}], "cna": {"title": "User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "specialk", "product": "User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "20260113"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-06T18:53:16.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-17T20:36:12.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02c5e3ad-5cc3-40b1-a15a-10d53383abe6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.php#L298"}, {"url": "https://plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.php#L1431"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3463696%40user-submitted-posts%2Ftrunk&old=3456521%40user-submitted-posts%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260113. This is due to the `usp_get_submitted_category()` function accepting user-submitted category IDs from the POST body without validating them against the admin-configured allowed categories stored in `usp_options['categories']`. This makes it possible for unauthenticated attackers to assign submitted posts to arbitrary categories, including restricted ones, by crafting a direct POST request with manipulated `user-submitted-category[]` values, bypassing the frontend category restrictions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-18T09:25:51.296Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2126", "state": "PUBLISHED", "dateUpdated": "2026-02-18T12:51:09.152Z", "dateReserved": "2026-02-06T18:37:48.354Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T09:25:51.296Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End", "vendor": "specialk", "versions": [{"lessThanOrEqual": "20260113", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260113. This is due to the `usp_get_submitted_category()` function accepting user-submitted category IDs from the POST body without validating them against the admin-configured allowed categories stored in `usp_options['categories']`. This makes it possible for unauthenticated attackers to assign submitted posts to arbitrary categories, including restricted ones, by crafting a direct POST request with manipulated `user-submitted-category[]` values, bypassing the frontend category restrictions."}, {"lang": "es", "value": "El plugin User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End para WordPress es vulnerable a una autorizaci\u00f3n incorrecta en todas las versiones hasta, e incluyendo, 20260113. Esto se debe a que la funci\u00f3n `usp_get_submitted_category()` acepta IDs de categor\u00eda enviadas por el usuario desde el cuerpo de la solicitud POST sin validarlas contra las categor\u00edas permitidas configuradas por el administrador y almacenadas en `usp_options['categories']`. Esto hace posible que atacantes no autenticados asignen publicaciones enviadas a categor\u00edas arbitrarias, incluyendo las restringidas, al crear una solicitud POST directa con valores `user-submitted-category[]` manipulados, eludiendo las restricciones de categor\u00eda del frontend."}], "id": "CVE-2026-2126", "lastModified": "2026-06-17T10:30:21.873", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2126", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T12:26:21.098592Z", "version": "2.0.3"}}]}, "published": "2026-02-18T10:16:15.173", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.php#L1431"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.php#L298"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3463696%40user-submitted-posts%2Ftrunk&old=3456521%40user-submitted-posts%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02c5e3ad-5cc3-40b1-a15a-10d53383abe6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,20260113]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End", "source": "cna", "vendor": "specialk"}, "product": "user_submitted_posts_\u2013_enable_users_to_submit_posts_from_the_front_end", "vendor": "specialk"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T00:39:46.107620+00:00", "value": {"mitigation_remediation": ["Upgrade the User Submitted Posts plugin to any release newer than 20260113, which contains the missing authorization check for category assignment.", "If a rapid update is not feasible, block or sanitize the 'user-submitted-category[]' parameter using a web application firewall or by adding a modest filter in the theme\u2019s functions.php to reject requests that include category IDs not present in the plugin\u2019s allowed list.", "After addressing the authorization flaw, audit the site\u2019s publicly visible content to identify any posts that may have been assigned to restricted categories by attackers and take corrective action."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated category assignment bypass"}, "threat_synthesis": {"affected_systems": "WordPress sites that use any version of the User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End plugin up to and including release 20260113. The affected component is the front\u2011end submission handler that processes the 'user-submitted-category[]' field.", "description_and_impact": "The User Submitted Posts plugin for WordPress fails to validate user\u2011supplied category identifiers against the administrator\u2011configured allowed list. As a result, anyone can supply arbitrary category IDs in a crafted POST request and force posts to be assigned to restricted or otherwise disallowed categories. The flaw does not provide direct code execution or database disclosure, but it undermines content integrity, enabling stealthy publication or defacement within protected sections.", "risk_and_exploitability": "The CVSS v3.1 score of 5.3 signals moderate severity. The EPSS score is below 1%, indicating a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending a direct HTTP POST containing crafted 'user-submitted-category[]' values to the plugin\u2019s category retrieval endpoint. Because the flaw is purely an authorization issue that can be exercised without authentication, the exploitation pathway is straightforward but currently rarely observed."}}}}, "created": "2026-02-19T10:20:29.460797+00:00", "updated": "2026-04-16T00:45:15.970851+00:00", "vendors": ["specialk", "specialk$PRODUCT$user_submitted_posts_\u2013_enable_users_to_submit_posts_from_the_front_end", "wordpress", "wordpress$PRODUCT$wordpress"]}