# WPComplete <= 2.9.5.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Completion Data Modification

- **ID:** WPSEC-2026-0610
- **Plugin:** WPComplete (`wpcomplete`), https://wordpress.org/plugins/wpcomplete/
- **Affected versions:** from 2.9.1 before 2.9.5.8
- **Fixed in:** 2.9.5.8 (Update to 2.9.5.8 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpcomplete
- **Fix released:** 2026-10-07
- **Published:** 2026-10-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0610/

## Description

The WPComplete plugin for WordPress is vulnerable to Missing Authorization in versions 2.9.1 up to, and including, 2.9.5.7. The post metabox save routine, the course rename routine, the 'Can Complete' and 'Assign to' bulk actions, and the button deletion AJAX action all act on a post identifier taken from the request without checking that the current user may edit that post. This makes it possible for authenticated attackers with contributor-level access and above to enable, reassign or reset the completion and course data of posts they do not own.

## References

- https://wpsec.com/vuln/WPSEC-2026-0610/
- https://plugins.svn.wordpress.org/wpcomplete/tags/2.9.5.8/
- https://wordpress.org/plugins/wpcomplete/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0610/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.