Unauthenticated Data Modification in Easy Post Submission Plugin

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the create_post() function, affecting all versions up to and including 2.3.0. The vulnerability resides in the rbsm_submit_post AJAX action, which is registered for unauthenticated users via wp_ajax_nopriv_rbsm_submit_post. Because the plugin lacks proper authorization checks when a postId parameter is provided during a request, an unauthenticated attacker can manipulate the title, content, excerpt, categories, and tags of any existing post on the affected WordPress site. Furthermore, an attacker can change the post status to draft, effectively unpublishing content. This represents a significant risk to site integrity and availability, as unauthorized parties can deface or remove public-facing content without administrative privileges.

Impact

Successful exploitation allows unauthenticated attackers to modify, deface, or unpublish any post on a WordPress site running the vulnerable plugin. This can lead to site-wide content integrity loss, unauthorized information disclosure via excerpt modification, or service disruption through the unpublishing of critical posts. The vulnerability affects all users of the Easy Post Submission plugin version 2.3.0 and below.

Recommendation

• Update the Easy Post Submission plugin to the latest version once a patch is available or remove the plugin if a patch is not provided.
• Implement WAF rules to monitor or block HTTP POST requests to wp-admin/admin-ajax.php where the action parameter is rbsm_submit_post.
• Audit WordPress post modification logs for suspicious activity occurring from unauthenticated sessions if the site is suspected to be under attack.