PT-2026-21887 · WordPress · Wpgsi: Spreadsheet Integration
Javmah
·
Publicado
2026-02-25
·
Atualizado
2026-03-02
·
CVE-2026-1916
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
WPGSI: Spreadsheet Integration plugin for WordPress versions through 3.8.3
Description
The WPGSI: Spreadsheet Integration plugin for WordPress is susceptible to unauthorized modification and data loss. This is due to the absence of proper capability checks and a weak authentication method. The REST API functions
wpgsi callBackFuncAccept and wpgsi callBackFuncUpdate lack authentication, allowing unauthenticated access because they use permission callback => ' return true'. The plugin employs a custom token-based validation system that relies on Base64-encoded JSON objects containing the user ID and email address, but this system is not cryptographically secured. Attackers can forge tokens using publicly available information—specifically, the administrator's email address and an active integration ID—to create, modify, and delete WordPress posts and pages when remote updates are enabled.Recommendations
Update to a version beyond 3.8.3.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wpgsi: Spreadsheet Integration