CVE-2026-1916 is a missing authorization vulnerability (CWE-862) in the WPGSI: Spreadsheet Integration WordPress plugin. The REST API functions `wpgsi_callBackFuncAccept` and `wpgsi_callBackFuncUpdate` use `permission_callback => '__return_true'`, allowing unauthenticated access. The plugin relies on a custom token-based validation using a Base64-encoded JSON object containing user ID and email, but this token is not cryptographically signed, making it forgeable. An attacker with knowledge of the administrator's email and an active integration ID can create, modify, or delete arbitrary WordPress posts and pages.

The vulnerability allows unauthenticated attackers to perform unauthorized modifications to WordPress content, specifically creating, updating, or deleting posts and pages. This can lead to significant integrity issues within the affected WordPress site. There is no direct confidentiality or availability impact noted. No known exploits in the wild have been reported as of the publication date.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restricting access to the affected REST API endpoints via web application firewall rules or disabling the plugin if not required may reduce exposure. Verify and limit knowledge of administrator email addresses and integration IDs to trusted personnel only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.