Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.10 - Authenticated (Editor+) Insecure Direct Object Reference to Arbitrary Post Deletion

ID

WPSEC-2026-2551

Plugin

Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode (coming-soon)

Affected

all versions before 6.20.11

Remediation

Update to 6.20.11 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness

CWE-639

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05

Attack surface

Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode on WPSec AttackSurface

Fix released

2026-11-04

Published

2026-11-05

Description

The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Insecure Direct Object Reference via the landing page trash, restore, delete and bulk action AJAX handlers in all versions up to, and including, 6.20.10. This is due to the handlers checking only the 'edit_others_posts' capability, and not whether the target ID is a SeedProd page or whether the user may delete that post. This makes it possible for authenticated attackers, with editor-level access and above, to trash or permanently delete arbitrary posts of any post type, including content they cannot otherwise manage, such as WooCommerce products and orders.

References

• https://wpsec.com/vuln/WPSEC-2026-2551/
• https://plugins.svn.wordpress.org/coming-soon/tags/6.20.11/
• https://wordpress.org/plugins/coming-soon/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS