CVE-2026-1935: WordPress LinkedIn Plugin Auth Bypass Flaw

CVE-2026-1935 Overview

CVE-2026-1935 affects the Company Posts for LinkedIn plugin for WordPress in all versions up to and including 1.0.0. The vulnerability is a missing authorization flaw [CWE-862] in the linkedin_company_post_reset_handler() function hooked to admin_post_reset_linkedin_company_post. The handler lacks a capability check, allowing authenticated users with Subscriber-level access or higher to delete LinkedIn post data stored in the site's options table. The flaw does not expose data confidentiality but compromises integrity of plugin-managed content.

Critical Impact
Authenticated attackers with Subscriber-level access can delete LinkedIn company post data from the WordPress options table without authorization checks.

Affected Products

Company Posts for LinkedIn plugin for WordPress, versions up to and including 1.0.0
WordPress sites with Subscriber-or-higher registration enabled
Any WordPress installation using the vulnerable plugin to manage LinkedIn company post data

Discovery Timeline

2026-03-21 - CVE-2026-1935 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-1935

Vulnerability Analysis

The Company Posts for LinkedIn plugin registers the linkedin_company_post_reset_handler() function against the admin_post_reset_linkedin_company_post action hook. WordPress invokes this hook for any authenticated user who submits a request to the admin-post.php endpoint with the matching action. The handler proceeds to reset LinkedIn post data in the options table without verifying that the requester holds an administrative capability such as manage_options. The result is an integrity-impacting issue scoped to plugin-managed data, not the broader WordPress configuration.

Root Cause

The root cause is a missing capability check [CWE-862] inside linkedin_company_post_reset_handler(). WordPress provides current_user_can() for gating privileged actions, but the function omits this guard before executing the reset logic. Any authenticated session — including the lowest-privileged Subscriber role — satisfies the hook's authentication requirement, and the absence of a nonce or capability assertion completes the gap.

Attack Vector

An attacker first obtains Subscriber-level credentials, which are trivial to acquire on sites permitting open registration. The attacker then issues an authenticated HTTP request to admin-post.php with the action parameter set to reset_linkedin_company_post. The vulnerable handler executes and deletes the LinkedIn company post data persisted in the wp_options table. No user interaction beyond the attacker's own request is required, and the attack is delivered entirely over the network.

The vulnerable handler is documented in the plugin source at line 625 of class-linkedin-company-posts-admin.php. See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-1935

Indicators of Compromise

HTTP POST or GET requests to /wp-admin/admin-post.php with the parameter action=reset_linkedin_company_post originating from low-privileged user sessions.
Unexpected loss or reset of LinkedIn company post entries within the wp_options table on affected sites.
Subscriber-role accounts generating traffic to admin-post.php endpoints, which is atypical for that role.

Detection Strategies

Review WordPress access logs for requests to admin-post.php carrying the reset_linkedin_company_post action and correlate against the authenticated user's role.
Enable WordPress audit logging plugins to capture option changes and identify deletions tied to the LinkedIn plugin's option keys.
Hunt for newly created Subscriber accounts shortly followed by privileged-looking admin endpoint activity.

Monitoring Recommendations

Alert on any non-administrator role invoking admin-post.php actions associated with plugin configuration changes.
Monitor the wp_options table for unexpected modifications to keys owned by the Company Posts for LinkedIn plugin.
Track open user-registration sites for sudden spikes in Subscriber account creation followed by admin-endpoint requests.

How to Mitigate CVE-2026-1935

Immediate Actions Required

Deactivate the Company Posts for LinkedIn plugin until a patched release above 1.0.0 is published and verified.
Disable open user registration, or restrict the default new-user role away from Subscriber where feasible.
Back up the wp_options table so that any deleted LinkedIn post data can be restored if exploitation is suspected.

Patch Information

At the time of NVD publication, all versions up to and including 1.0.0 are affected. Apply the vendor-released update once available. Consult the Wordfence Vulnerability Report for the latest fixed-version information.

Workarounds

Block unauthenticated and low-privileged access to admin-post.php?action=reset_linkedin_company_post at the web application firewall layer.
Audit and remove untrusted Subscriber accounts to shrink the pool of users that can reach the vulnerable hook.
Apply a custom mu-plugin that wraps the handler with a current_user_can('manage_options') check until the official patch ships.

bash

# Example nginx rule to block exploitation attempts
location = /wp-admin/admin-post.php {
    if ($arg_action = "reset_linkedin_company_post") {
        return 403;
    }
}