{
 "id": "WPSEC-2026-0610",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0610/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0610/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0610/index.md",
 "title": "WPComplete <= 2.9.5.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Completion Data Modification",
 "description": "The WPComplete plugin for WordPress is vulnerable to Missing Authorization in versions 2.9.1 up to, and including, 2.9.5.7. The post metabox save routine, the course rename routine, the 'Can Complete' and 'Assign to' bulk actions, and the button deletion AJAX action all act on a post identifier taken from the request without checking that the current user may edit that post. This makes it possible for authenticated attackers with contributor-level access and above to enable, reassign or reset the completion and course data of posts they do not own.",
 "plugin": {
  "slug": "wpcomplete",
  "name": "WPComplete",
  "full_name": "WPComplete",
  "wordpress_org": "https://wordpress.org/plugins/wpcomplete/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpcomplete/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpcomplete"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.9.1",
    "from_inclusive": true,
    "to": "2.9.5.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.9.1 before 2.9.5.8"
  ]
 },
 "introduced_in": "2.9.1",
 "fixed_in": "2.9.5.8",
 "remediation": "Update to 2.9.5.8 or later.",
 "fix_released": "2026-10-07T00:43:19+00:00",
 "published": "2026-10-08T01:41:04+00:00",
 "updated": "2026-10-07T15:31:04.054337+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0610/",
  "https://plugins.svn.wordpress.org/wpcomplete/tags/2.9.5.8/",
  "https://wordpress.org/plugins/wpcomplete/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpcomplete",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-07"
 }
}