PT-2026-140245

CVE-2026-121759

Publicado

2026-11-09

Atualizado

2026-11-09

Descrição por

CVSS 3.1

4.9

Média

MétricasAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash is disabled.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Claudio Marchesini

Dottor Marc

Enrico Marcolini

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-639: Authorization Bypass Through User-Controlled Key