What the vulnerability does
01Description
The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution.
Explanation of Vulnerability in Simple Terms
02Summary
Xpro Addons for Elementor versions up to 1.5.1 lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can alter data through the plugin's widgets. Update to a version newer than 1.5.1 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify or alter content and settings they should not have permission to change.
Potential impact on your site
04Site Impact
Unauthorized users can tamper with site content, potentially defacing pages or altering widget configurations.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
August 5, 2026
CVE published
August 5, 2026
Record updated
