CVE-2026-94505
Received Received - Intake

Authorization Bypass in Nelio Content WordPress Plugin

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: Wordfence

Description
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-94505
EUVD
EUVD-2026-91961

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nelio content to 4.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Nelio Content plugin for WordPress has an authorization bypass vulnerability in versions up to 4.5.0. This flaw allows authenticated attackers with contributor-level access or higher to permanently delete reusable social messages without proper authorization checks.

Detection Guidance

Check WordPress installations for the Nelio Content plugin versions up to 4.5.0. Look for unauthorized deletion of reusable social messages or unusual activity by contributor-level users.

Impact Analysis

Attackers could delete important social media content, including posts by administrators or other privileged users. This could disrupt social media scheduling, content management, and overall editorial workflows.

Compliance Impact

This vulnerability allows authenticated attackers with contributor-level access to permanently delete any reusable social message, including those authored by administrators. This could lead to unauthorized data deletion, potentially violating GDPR's integrity principle or HIPAA's integrity and availability requirements if such messages contain regulated data.

Mitigation Strategies

Update the Nelio Content plugin to the latest version beyond 4.5.0 immediately. Remove contributor-level access for users who do not need it. Monitor for unauthorized deletions of posts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart