CVE-2026-4431

Name of the Vulnerable Software and Affected Versions Easy Post Submission versions prior to 2.3.1

Description The plugin allows unauthorized modification of data because the create post() function lacks a capability check. The rbsm submit post AJAX action is registered for unauthenticated users via wp ajax nopriv rbsm submit post without authorization checks when the postId parameter is provided. This allows unauthenticated attackers to modify the title, content, excerpt, categories, and tags of arbitrary posts, or change the post status to draft to effectively unpublish them using the postId parameter.

Recommendations Update the plugin to a version later than 2.3.0.