{
 "id": "WPSEC-2026-2551",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2551/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2551/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2551/index.md",
 "title": "Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.10 - Authenticated (Editor+) Insecure Direct Object Reference to Arbitrary Post Deletion",
 "description": "The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Insecure Direct Object Reference via the landing page trash, restore, delete and bulk action AJAX handlers in all versions up to, and including, 6.20.10. This is due to the handlers checking only the 'edit_others_posts' capability, and not whether the target ID is a SeedProd page or whether the user may delete that post. This makes it possible for authenticated attackers, with editor-level access and above, to trash or permanently delete arbitrary posts of any post type, including content they cannot otherwise manage, such as WooCommerce products and orders.",
 "plugin": {
  "slug": "coming-soon",
  "name": "Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode",
  "full_name": "Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode",
  "wordpress_org": "https://wordpress.org/plugins/coming-soon/",
  "advisories_url": "https://wpsec.com/vuln/plugin/coming-soon/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/coming-soon"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.20.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.20.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.20.11",
 "remediation": "Update to 6.20.11 or later.",
 "fix_released": "2026-11-04T09:14:36+00:00",
 "published": "2026-11-05T09:48:23+00:00",
 "updated": "2026-11-04T13:57:28.426295+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2551/",
  "https://plugins.svn.wordpress.org/coming-soon/tags/6.20.11/",
  "https://wordpress.org/plugins/coming-soon/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/coming-soon",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-05"
 }
}