CVE-2026-96532

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

  • Published Sep 26, 2026
  • CVSS 7.5 high
  • 0.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-96532 at the National Vulnerability Database