Vulnerabilities / WPComplete / WPSEC-2026-0610
WPComplete <= 2.9.5.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Completion Data Modification
Medium 4.3
CWE-862Fixed in 2.9.5.8
- ID
- WPSEC-2026-0610
- Plugin
- WPComplete (wpcomplete)
- Affected
- from 2.9.1 before 2.9.5.8
- Remediation
- Update to 2.9.5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-07
- Attack surface
- WPComplete on WPSec AttackSurface
- Fix released
- Published
Description
The WPComplete plugin for WordPress is vulnerable to Missing Authorization in versions 2.9.1 up to, and including, 2.9.5.7. The post metabox save routine, the course rename routine, the 'Can Complete' and 'Assign to' bulk actions, and the button deletion AJAX action all act on a post identifier taken from the request without checking that the current user may edit that post. This makes it possible for authenticated attackers with contributor-level access and above to enable, reassign or reset the completion and course data of posts they do not own.
References
- https://wpsec.com/vuln/WPSEC-2026-0610/
- https://plugins.svn.wordpress.org/wpcomplete/tags/2.9.5.8/
- https://wordpress.org/plugins/wpcomplete/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS