PT-2026-26827 · WordPress · Company Posts For Linkedin

Abhirup Konwar · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-1935

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Company Posts for LinkedIn plugin for WordPress versions prior to 1.0.1

Description The software is susceptible to a missing authorization issue. This is caused by a missing capability check within the linkedin company post reset handler() function, which is connected to the admin post reset linkedin company post action. Attackers with Subscriber-level access or higher can delete LinkedIn post data stored in the site’s options table.

Recommendations Update The Company Posts for LinkedIn plugin for WordPress to version 1.0.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1935

Affected Products

Company Posts For Linkedin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1935 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4c635405-997e-44ea-8851-7d09051307ad?source=cve · Note
• https://plugins.trac.wordpress.org/browser/company-posts-for-linkedin/trunk/admin/class-linkedin-company-posts-admin.php#L625 · Note
• https://plugins.trac.wordpress.org/browser/company-posts-for-linkedin/tags/1.0.0/admin/class-linkedin-company-posts-admin.php#L625 · Note
• https://twitter.com/CVEnew/status/2035237285017641034 · Twitter Post