PT-2026-21887 · WordPress · Wpgsi: Spreadsheet Integration

Javmah

·

Published

2026-02-25

·

Updated

2026-03-02

·

CVE-2026-1916

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions WPGSI: Spreadsheet Integration plugin for WordPress versions through 3.8.3
Description The WPGSI: Spreadsheet Integration plugin for WordPress is susceptible to unauthorized modification and data loss. This is due to the absence of proper capability checks and a weak authentication method. The REST API functions wpgsi callBackFuncAccept and wpgsi callBackFuncUpdate lack authentication, allowing unauthenticated access because they use permission callback => ' return true'. The plugin employs a custom token-based validation system that relies on Base64-encoded JSON objects containing the user ID and email address, but this system is not cryptographically secured. Attackers can forge tokens using publicly available information—specifically, the administrator's email address and an active integration ID—to create, modify, and delete WordPress posts and pages when remote updates are enabled.
Recommendations Update to a version beyond 3.8.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1916

Affected Products

Wpgsi: Spreadsheet Integration