CVE-2026-94505
HIGH
8,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: high
Description
AI Translation Available
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
862
Missing Authorization
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Availability
Potential Impacts:
Read Application Data
Read Files Or Directories
Modify Application Data
Modify Files Or Directories
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Applicable Platforms
Technologies:
AI/ML, Web Server, Database Server, Not Technology-Specific
https://plugins.trac.wordpress.org/browser/nelio-content/tags/4.5.0/includes/po…
https://plugins.trac.wordpress.org/browser/nelio-content/tags/4.5.0/includes/po…
https://plugins.trac.wordpress.org/browser/nelio-content/tags/4.5.0/includes/ut…
https://plugins.trac.wordpress.org/changeset/3724505/nelio-content/tags/4.5.1
https://www.wordfence.com/threat-intel/vulnerabilities/id/828050ce-4775-4256-8d…