{
 "id": "WPSEC-2026-1277",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1277/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1277/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1277/index.md",
 "title": "Strong Testimonials <= 3.3.14 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Meta Modification",
 "description": "The Strong Testimonials plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'post_ID' parameter of the testimonial custom-field save routine in all versions up to, and including, 3.3.14. This is due to the save_details() function, which runs whenever a testimonial is saved, writing every submitted 'custom' key to the post ID taken from the request instead of the post actually being saved. It does not check that the user can edit that post and does not limit keys to the registered custom fields. This makes it possible for authenticated attackers with contributor-level access and above, who can get the metabox nonce from the testimonial editor, to add or overwrite arbitrary post meta on posts they are not permitted to edit. They do this by submitting a testimonial through the plugin's form.",
 "plugin": {
  "slug": "strong-testimonials",
  "name": "Strong Testimonials",
  "full_name": "Strong Testimonials",
  "wordpress_org": "https://wordpress.org/plugins/strong-testimonials/",
  "advisories_url": "https://wpsec.com/vuln/plugin/strong-testimonials/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/strong-testimonials"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.15",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.15"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.15",
 "remediation": "Update to 3.3.15 or later.",
 "fix_released": "2026-10-20T09:26:39+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:07.416037+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1277/",
  "https://plugins.svn.wordpress.org/strong-testimonials/tags/3.3.15/",
  "https://wordpress.org/plugins/strong-testimonials/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/strong-testimonials",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-21"
 }
}