high7.5
CVE-2026-96532
The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form…
Impact
The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.
Affected products
| Product | Affected versions |
|---|---|
| Testimonials Widget WordPress Plugin | through 4.0.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.