What the vulnerability does
01Description
The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to the plugin not validating a user's access to a post before modifying its metadata in the 'bulk_save' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to update the last modified metadata and lock the modification date of arbitrary posts, including those created by Administrators via the 'post_ids' parameter.
Explanation of Vulnerability in Simple Terms
02Summary
WP Last Modified Info versions 1.9.5 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify site data over the network. The vulnerability requires no user interaction and affects the integrity of stored information. Site administrators should update to a version newer than 1.9.5 as soon as possible.
What an attacker can do
03Attacker Capabilities
Modify site data without logging in or having permission to do so.
Potential impact on your site
04Site Impact
Attackers can alter site content or settings without authorization, potentially defacing pages or corrupting data.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
February 14, 2026
CVE published
April 8, 2026
Record updated
