CVE-2026-110371 in Strong Testimonials Plugin
Summary
by MITRE • 10/15/2026
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The identified security flaw represents a critical failure in access control mechanisms within the Strong Testimonials plugin for WordPress, specifically affecting versions ranging from initial releases up to version 3.3.12. This vulnerability is classified as an improper authorization issue where the application fails to enforce adequate restrictions on authenticated users regarding which resources they can access or modify. In web applications, proper authorization ensures that a user can only perform actions and access data appropriate for their assigned role and permissions. When this logic is flawed, it creates a scenario known as insecure direct object references or broken access control, allowing individuals with lower privilege levels to interact with administrative functions or view sensitive data intended for higher-privileged users such as administrators.
From a technical perspective, the root cause lies in the server-side validation of user permissions before processing requests related to testimonial management. The plugin likely accepts input parameters that dictate actions like editing, deleting, or viewing testimonials without sufficiently verifying if the requesting user possesses the necessary capabilities defined by WordPress roles and capabilities architecture. This oversight permits an attacker who has obtained valid credentials for a low-privilege account, such as a subscriber or contributor role, to manipulate HTTP requests directly. By modifying specific parameters in API calls or form submissions associated with testimonial management endpoints, the attacker can bypass intended security boundaries. The vulnerability does not require complex exploitation techniques; rather, it relies on the fundamental absence of server-side checks that confirm user authority for each action performed against the database records.
The operational impact of this vulnerability is significant as it compromises the integrity and confidentiality of content managed by the plugin. An attacker can exploit this flaw to modify or delete testimonials created by other users without authorization, leading to data loss or defacement of public-facing content. Furthermore, depending on how the testimonial data is rendered and stored, there may be secondary risks involving cross-site scripting if malicious input is saved through these unauthorized modification endpoints. The ability to alter administrative settings or access private customer feedback undermines trust in the website's reliability and exposes sensitive business information that was intended to remain restricted. This type of vulnerability directly impacts the availability and integrity aspects of the security triad, potentially causing reputational damage and operational disruption for site owners who rely on accurate testimonial displays.
This issue aligns with CWE-269, which describes Improper Privilege Control, indicating a failure in enforcing least privilege principles during runtime operations. It also maps to MITRE ATT&CK technique T1078, specifically Valid Accounts and potentially T1548 if it involves abuse of system configuration settings for elevation of privilege. To mitigate this risk, immediate action is required by updating the Strong Testimonials plugin to a version later than 3.3.12 where these access control checks have been corrected. In addition to patching, administrators should enforce strong password policies and multi-factor authentication for all user accounts to reduce the likelihood of credential compromise that facilitates exploitation. Regular security audits and code reviews focusing on authorization logic are recommended to prevent similar flaws in custom plugins or themes, ensuring that every request is validated against current user permissions before execution.