What the vulnerability does
01Description
The GP Unique ID plugin for WordPress is vulnerable to Unique ID Modification in all versions up to, and including, 1.5.5. This is due to insufficient input validation. This makes it possible for unauthenticated attackers to tamper with the generation of a unique ID on a form submission and replace the generated unique ID with a user-controlled one, leading to a loss of integrity in cases where the ID's uniqueness is relied upon in a security-specific context.
Explanation of Vulnerability in Simple Terms
02Summary
GP Unique ID versions 1.5.5 and earlier contain an input validation flaw that allows attackers to modify data integrity without authentication. The vulnerability requires only network access and no user interaction. Site administrators should update to a version newer than 1.5.5 to prevent unauthorized data modification.
What an attacker can do
03Attacker Capabilities
Modify site data without authentication or user interaction.
Potential impact on your site
04Site Impact
Attackers can alter site data, potentially affecting content accuracy and user trust.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user action required.
Key dates
06Disclosure timeline
May 2, 2024
CVE published
April 8, 2026
Record updated
