CVE-2026-1786 MEDIUM

CVE-2026-1786: Twitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update

Vendor Badbreze
Product Twitter posts to Blog
Weakness CWE-862 · Missing authorization
Published February 11, 2026
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' function in all versions up to, and including, 1.11.25. This makes it possible for unauthenticated attackers to update plugin settings including Twitter API credentials, post author, post status, and the capability required to access the plugin's admin menu.

Explanation of Vulnerability in Simple Terms

02Summary

Twitter Posts to Blog versions up to 1.11.25 lack proper authorization checks, allowing unauthenticated attackers to modify or delete blog content. The vulnerability requires only network access and no user interaction. Site administrators should update to a version newer than 1.11.25 to restore access controls.

What an attacker can do

03Attacker Capabilities

Modify or delete blog posts without logging in.

Potential impact on your site

04Site Impact

Blog content can be altered or removed by anyone on the internet without your permission.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

February 11, 2026 CVE published
April 8, 2026 Record updated