CVE-2026-96532 — Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update
The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthe…
Published: 2026-09-26 · CVSS: 7.5 · CVSS 3.1
The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7