CVE-2026-7105 is a missing authorization vulnerability (CWE-862) in the Xpro Addons plugin for WordPress, affecting all versions up to and including 1.5.1. The vulnerability arises from the absence of a capability check in the get_menu_content_editor() function, enabling authenticated users with low privileges (Subscriber and above) to create arbitrary published posts of the xpro_content custom post type. These posts are publicly queryable, allowing attackers to inject content that can be used for SEO spam and to pollute the database.

Authenticated attackers with Subscriber-level access or higher can create arbitrary published content on the site without proper authorization. This can lead to content injection, SEO spam, and database pollution. There is no direct confidentiality or availability impact reported. The vulnerability has a CVSS 3.1 score of 4.3 (medium severity), indicating limited impact primarily on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for unauthorized content creation. Avoid granting Subscriber or higher privileges to untrusted users. Review and remove any unauthorized xpro_content posts found on the site.