Security readout for executives and security teams
Plain-English summary
CVE-2026-2126 affects the WordPress User Submitted Posts plugin. Unauthenticated visitors can bypass configured front-end category restrictions and place submitted posts into categories that site administrators intended to restrict. This is an integrity issue, not a data theft or service outage issue based on the published CVSS.
Executive priority
Treat as a moderate-priority WordPress integrity issue. It is unlikely to cause direct data loss, but it can undermine publishing controls and moderation workflows. Prioritize sites where public submissions feed visible content, restricted categories, SEO workflows, or compliance-sensitive publishing processes.
Technical view
The plugin’s usp_get_submitted_category() accepts category IDs from POST data without validating them against admin-configured allowed categories in usp_options['categories']. Versions up to and including 20260113 are described as vulnerable. The issue is CWE-863, incorrect authorization, with CVSS 3.1 score 5.3, network exploitable and unauthenticated.
Likely exposure
Exposure is limited to WordPress sites using this plugin with front-end post submissions enabled, especially where category restrictions are part of moderation, publishing workflow, or content governance. Sites not using the plugin, or not relying on category restrictions, have lower practical impact.
Exploitation context
The CVE states exploitation requires a crafted direct POST request and no authentication. CISA KEV is false in the provided data, and no cited source states active exploitation. Impact is limited to unauthorized category assignment for submitted posts.
Researcher notes
Key evidence is the CVE description, Wordfence advisory, WordPress Trac references, and a related changeset. The affected-range data is inconsistent in the bundle, but the narrative states all versions up to and including 20260113. No public source in the bundle confirms active exploitation.
Mitigation direction
- Check vendor or WordPress plugin guidance for a fixed release beyond 20260113.
- Update the User Submitted Posts plugin when a fixed version is available.
- Temporarily disable front-end submissions if restricted categories are business-critical.
- Moderate submitted posts before publication, especially category assignment.
- Review plugin configuration for allowed categories and publishing workflow assumptions.
Validation and detection
- Inventory WordPress sites for the User Submitted Posts plugin.
- Flag installations at version 20260113 or earlier as potentially affected.
- Confirm whether front-end post submission is enabled.
- Review whether restricted categories carry business, compliance, or editorial impact.
- After remediation, verify submissions cannot use categories outside the configured allowed list.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-2126 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/02c5e3ad-5cc3-40b1-a15a-10d53383abe6?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/user-submitted-posts/tags/20260113/user-submitted-posts.php#L298CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3463696%40user-submitted-posts%2Ftrunk&old=3456521%40user-submitted-posts%2Ftrunk&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.