What the vulnerability does
01Description
The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, allowing them to change post titles, content, excerpts, and remove post authors.
Explanation of Vulnerability in Simple Terms
02Summary
The Frontend Post Submission Manager Lite plugin for WordPress does not properly check user permissions before allowing certain actions. An unauthenticated attacker can modify post data without authorization. The vulnerability affects versions 1.2.5 and earlier. Site administrators should update to a version newer than 1.2.5 as soon as a patch becomes available.
What an attacker can do
03Attacker Capabilities
Modify post content or metadata without logging in or having permission to do so.
Potential impact on your site
04Site Impact
Unauthorized users can alter published posts, drafts, or post metadata, potentially defacing content or injecting malicious data.
Conditions required to exploit
05Prerequisites
No authentication or user interaction required; attacker needs only network access to the site.
Key dates
06Disclosure timeline
December 21, 2025
CVE published
April 8, 2026
Record updated
