CVE-2026-2126
Description
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260113. This is due to the usp_get_submitted_category() function accepting user-submitted category IDs from the POST body without validating them against the admin-configured allowed categories stored in usp_options['categories']. This makes it possible for unauthenticated attackers to assign submitted posts to arbitrary categories, including restricted ones, by crafting a direct POST request with manipulated user-submitted-category[] values, bypassing the frontend category restrictions.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.phpnvd
- plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.phpnvd
- plugins.trac.wordpress.org/changesetnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/02c5e3ad-5cc3-40b1-a15a-10d53383abe6nvd
News mentions
0No linked articles in our index yet.