CVE-2026-7105
Received Received - Intake

Unauthorized Post Creation in Xpro Addons WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-7105
EUVD
EUVD-2026-53187

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xpro addons to 1.5.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Xpro Addons plugin for WordPress has a vulnerability due to a missing capability check in the get_menu_content_editor() function. This allows authenticated attackers with Subscriber-level access or higher to create arbitrary published posts of the xpro_content custom post type with attacker-controlled titles. These posts are publicly visible on the front-end.

Detection Guidance

Check WordPress sites for the Xpro Addons plugin version 1.5.1 or lower. Look for unauthorized posts of type xpro_content with attacker-controlled titles. Review user roles with Subscriber access or higher for unusual activity.

Impact Analysis

This vulnerability enables content injection, SEO spam, and database pollution. Attackers could create misleading or harmful content on your WordPress site, potentially damaging your site's reputation or SEO rankings.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized content creation. Attackers can inject arbitrary posts, which may include sensitive or misleading information, violating data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Update the Xpro Addons plugin to the latest version. Remove or disable the plugin if no update is available. Review and restrict Subscriber-level user permissions. Monitor for unauthorized posts of type xpro_content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7105. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart