PT-2026-20377 · WordPress · Wordpress+1

Specialk · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-2126

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress versions prior to 20260114

Description The software is susceptible to an authorization issue. This is due to the usp get submitted category() function improperly handling user-supplied category IDs received in the POST request body. Specifically, the function does not validate these IDs against the allowed categories configured by the administrator and stored in usp options['categories']. This allows unauthenticated attackers to assign submitted posts to any category, including restricted ones, by manipulating the user-submitted-category[] values in a direct POST request, effectively bypassing frontend category restrictions.

Recommendations Update to a version later than 20260113.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-2126

Affected Products

User Submitted Posts

Wordpress

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2126 · Security Note
• https://twitter.com/CVEnew/status/2024063183468826676 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/02c5e3ad-5cc3-40b1-a15a-10d53383abe6?source=cve · Note
• https://t.me/CVEtracker/44963 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3463696%40user-submitted-posts%2Ftrunk&old=3456521%40user-submitted-posts%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.php#L298 · Note
• https://plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.php#L1431 · Note
• https://t.me/cveNotify/152302 · Telegram Post