Unauthenticated Post Modification in WordPress Testimonials Widget

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Testimonials Widget WordPress plugin through version 4.0.4 contains a critical authorization bypass vulnerability that allows unauthenticated users to create, modify, and overwrite arbitrary posts on affected WordPress installations. The plugin fails to implement capability checks on its front-end testimonial submission form, meaning any visitor—authenticated or not—can manipulate post titles, content, and authorship metadata. This vulnerability is particularly dangerous for WordPress sites relying on this plugin for user-generated content, as attackers can deface content, inject malicious code into posts, impersonate legitimate authors, or use the compromised site as a staging ground for further attacks. Organizations running Testimonials Widget 4.0.4 or earlier should treat this as a high-priority patching issue, especially if their sites handle sensitive information or rely on post integrity for business operations.

Casky's 283 matching skills, powered by Claude AI's extended reasoning capabilities, detect the attack patterns associated with this vulnerability across two critical MITRE ATT&ACK tactics: Privilege Escalation (TA0004) and Credential Access (TA0006). Practitioners using Casky would observe detection signals mapping to techniques like Abuse of Elevation Control Mechanism (T1548) when the plugin bypasses WordPress capability checks, and patterns consistent with Exploitation for Privilege Escalation (T1190) as attackers leverage the missing authorization logic. The platform's skills would flag anomalous POST requests to the testimonial submission endpoint originating from unauthenticated sources, POST parameter patterns attempting to set post_author or post_content fields, and database write operations that lack corresponding user capability verification. Security teams would see correlations between successful post modifications and requests lacking proper nonce validation or user role verification, enabling them to identify exploitation attempts before posts are compromised and to implement compensating controls like Web Application Firewall rules blocking suspicious testimonial form submissions.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-96532.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-96532

Casky has 283 skills that investigate the attack patterns behind CVE-2026-96532. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn