# Strong Testimonials <= 3.3.14 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Meta Modification

- **ID:** WPSEC-2026-1277
- **Plugin:** Strong Testimonials (`strong-testimonials`), https://wordpress.org/plugins/strong-testimonials/
- **Affected versions:** all versions before 3.3.15
- **Fixed in:** 3.3.15 (Update to 3.3.15 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/strong-testimonials
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1277/

## Description

The Strong Testimonials plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'post_ID' parameter of the testimonial custom-field save routine in all versions up to, and including, 3.3.14. This is due to the save_details() function, which runs whenever a testimonial is saved, writing every submitted 'custom' key to the post ID taken from the request instead of the post actually being saved. It does not check that the user can edit that post and does not limit keys to the registered custom fields. This makes it possible for authenticated attackers with contributor-level access and above, who can get the metabox nonce from the testimonial editor, to add or overwrite arbitrary post meta on posts they are not permitted to edit. They do this by submitting a testimonial through the plugin's form.

## References

- https://wpsec.com/vuln/WPSEC-2026-1277/
- https://plugins.svn.wordpress.org/strong-testimonials/tags/3.3.15/
- https://wordpress.org/plugins/strong-testimonials/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1277/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.