Strong Testimonials <= 3.3.14 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Meta Modification
- ID
- WPSEC-2026-1277
- Plugin
- Strong Testimonials (strong-testimonials)
- Affected
- all versions before 3.3.15
- Remediation
- Update to 3.3.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- Strong Testimonials on WPSec AttackSurface
- Fix released
- Published
Description
The Strong Testimonials plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'post_ID' parameter of the testimonial custom-field save routine in all versions up to, and including, 3.3.14. This is due to the save_details() function, which runs whenever a testimonial is saved, writing every submitted 'custom' key to the post ID taken from the request instead of the post actually being saved. It does not check that the user can edit that post and does not limit keys to the registered custom fields. This makes it possible for authenticated attackers with contributor-level access and above, who can get the metabox nonce from the testimonial editor, to add or overwrite arbitrary post meta on posts they are not permitted to edit. They do this by submitting a testimonial through the plugin's form.
References
- https://wpsec.com/vuln/WPSEC-2026-1277/
- https://plugins.svn.wordpress.org/strong-testimonials/tags/3.3.15/
- https://wordpress.org/plugins/strong-testimonials/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS