CVE-2026-96532: CWE-862 Missing Authorization in Testimonials Widget
The Testimonials Widget WordPress plugin up to version 4.0.4 has a missing authorization vulnerability in its front-end testimonial submission form. This flaw allows unauthenticated users to create or modify arbitrary posts, including changing the title, content, and author fields of any existing post.
AI Analysis
Technical Summary
CVE-2026-96532 is a missing authorization vulnerability (CWE-862) in the Testimonials Widget WordPress plugin through version 4.0.4. The plugin fails to perform capability or ownership checks on its front-end testimonial submission form, enabling unauthenticated attackers to create or overwrite posts arbitrarily. This includes modifying critical post attributes such as title, content, and author, potentially leading to unauthorized content manipulation on affected WordPress sites.
Potential Impact
Unauthenticated users can create or modify any post on a WordPress site using the vulnerable Testimonials Widget plugin, which can lead to content tampering, misinformation, or defacement. This unauthorized modification undermines content integrity and could affect site trustworthiness or functionality.
Mitigation Recommendations
No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or disable the Testimonials Widget plugin's front-end submission form or apply access controls to prevent unauthenticated submissions.
CVE-2026-96532: CWE-862 Missing Authorization in Testimonials Widget
Description
The Testimonials Widget WordPress plugin up to version 4.0.4 has a missing authorization vulnerability in its front-end testimonial submission form. This flaw allows unauthenticated users to create or modify arbitrary posts, including changing the title, content, and author fields of any existing post.
Affected software
Testimonials Widget
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-96532 is a missing authorization vulnerability (CWE-862) in the Testimonials Widget WordPress plugin through version 4.0.4. The plugin fails to perform capability or ownership checks on its front-end testimonial submission form, enabling unauthenticated attackers to create or overwrite posts arbitrarily. This includes modifying critical post attributes such as title, content, and author, potentially leading to unauthorized content manipulation on affected WordPress sites.
Potential Impact
Unauthenticated users can create or modify any post on a WordPress site using the vulnerable Testimonials Widget plugin, which can lead to content tampering, misinformation, or defacement. This unauthorized modification undermines content integrity and could affect site trustworthiness or functionality.
Mitigation Recommendations
No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or disable the Testimonials Widget plugin's front-end submission form or apply access controls to prevent unauthenticated submissions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-23T11:24:56.363Z
- State
- PUBLISHED
Threat ID: 6ab7672ef7a7c54106f7c89b
Added to database: 09/26/2026, 06:33:18 UTC
Last enriched: 09/26/2026, 06:47:42 UTC
Last updated: 09/26/2026, 06:57:32 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.