CVE-2026-7105 in Xpro Addons Plugin
Summary
by MITRE • 08/05/2026
The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in the Xpro Addons plugin for WordPress represents a critical authorization flaw that undermines the security model of the content management system. This issue affects all versions up to and including 1.5.1, where the `get_menu_content_editor()` function fails to perform proper capability checks before allowing data creation operations. The flaw enables authenticated attackers who possess Subscriber-level permissions or higher to exploit this weakness and generate malicious content within the WordPress environment.
The technical implementation of this vulnerability stems from the absence of proper access control validation within the plugin's administrative functions. When an authenticated user with sufficient privileges calls the `get_menu_content_editor()` function, the system does not verify whether the requesting user possesses the appropriate permissions to create posts of the `xpro_content` custom post type. This missing capability check creates a direct pathway for privilege escalation and unauthorized content manipulation.
The operational impact of this vulnerability extends beyond simple data creation, as it enables attackers to inject malicious content into publicly accessible areas of the website. The created posts are immediately available through the front-end interface and are publicly queryable, making them visible to search engines and visitors. This characteristic transforms the vulnerability from a mere data manipulation issue into a serious security threat that can be exploited for content injection attacks, SEO spam operations, and database pollution activities.
Security researchers have identified this as a classic example of insufficient authorization checking, which aligns with common weakness identifiers such as CWE-284. The vulnerability creates opportunities for attackers to leverage the compromised plugin functionality in accordance with attack techniques documented under the ATT&CK framework, particularly those related to privilege escalation and persistence mechanisms. The ability to create published posts with attacker-controlled content provides malicious actors with a method to establish a persistent presence on the target website while potentially manipulating search engine rankings through SEO spam tactics.
Organizations should implement immediate mitigations including updating to the latest version of the Xpro Addons plugin where this vulnerability has been addressed, or implementing additional access control measures through custom code modifications. Security teams should also monitor their WordPress installations for similar authorization flaws in other plugins and themes, as this pattern of missing capability checks represents a common security oversight in WordPress plugin development. Additionally, administrators should consider implementing web application firewalls and monitoring systems to detect unauthorized content creation activities that may indicate exploitation attempts against this vulnerability.