WordPress Nelio Content Authorization Bypass Enables Content Deletion

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Nelio Content plugin for WordPress fails to properly validate user permissions when processing requests to delete reusable social messages. This authorization bypass vulnerability allows authenticated users with contributor-level access—typically intended for basic content creation—to permanently delete social media content created by administrators and other privileged users. With over 283 security skills mapped to this threat pattern, the vulnerability is particularly dangerous in multi-author WordPress environments where content calendars and social strategies are managed collaboratively. The CVSS score of 8.1 reflects the high impact of unauthorized deletion of critical business assets and potential disruption of social media campaigns.

Casky.ai's security skills detect the attack patterns underlying this vulnerability by monitoring for Privilege Escalation (TA0004) and Credential Access (TA0006) techniques that manifest as suspicious authorization decisions. Practitioners using Casky would observe findings indicating: (1) HTTP requests with insufficient permission checks on DELETE operations targeting nc_reusable_social post types, (2) role-based access control (RBAC) bypass patterns where contributor tokens successfully modify administrator-owned resources, and (3) audit trail anomalies showing lower-privileged users performing actions outside their delegated scope. Claude's extended reasoning across the 283 mapped skills would correlate these findings with known WordPress authorization bypass patterns, surfacing the specific plugin version ranges affected and recommending immediate patching, user role auditing, and enhanced logging on social media management endpoints.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-94505.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-94505

Casky has 283 skills that investigate the attack patterns behind CVE-2026-94505. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn