# Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.10 - Authenticated (Editor+) Insecure Direct Object Reference to Arbitrary Post Deletion

- **ID:** WPSEC-2026-2551
- **Plugin:** Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode (`coming-soon`), https://wordpress.org/plugins/coming-soon/
- **Affected versions:** all versions before 6.20.11
- **Fixed in:** 6.20.11 (Update to 6.20.11 or later.)
- **Severity:** Low 3.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/coming-soon
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2551/

## Description

The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Insecure Direct Object Reference via the landing page trash, restore, delete and bulk action AJAX handlers in all versions up to, and including, 6.20.10. This is due to the handlers checking only the 'edit_others_posts' capability, and not whether the target ID is a SeedProd page or whether the user may delete that post. This makes it possible for authenticated attackers, with editor-level access and above, to trash or permanently delete arbitrary posts of any post type, including content they cannot otherwise manage, such as WooCommerce products and orders.

## References

- https://wpsec.com/vuln/WPSEC-2026-2551/
- https://plugins.svn.wordpress.org/coming-soon/tags/6.20.11/
- https://wordpress.org/plugins/coming-soon/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2551/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.