CVE-2026-7105 Overview
CVE-2026-7105 is a missing authorization vulnerability in the Xpro Addons plugin for WordPress. The flaw affects all versions up to and including 1.5.1. The get_menu_content_editor() function lacks a capability check, allowing authenticated users with Subscriber-level access or higher to create arbitrary published posts of the xpro_content custom post type. Attackers control the post titles, and the resulting posts are publicly queryable on the front-end. This enables content injection, search engine optimization (SEO) spam, and database pollution on affected WordPress sites.
Critical Impact
Authenticated attackers with minimal privileges can inject arbitrary published posts into WordPress sites running Xpro Addons ≤ 1.5.1, enabling SEO spam and content pollution.
Affected Products
- Xpro Addons plugin for WordPress (also known as xpro-elementor-addons)
- All versions up to and including 1.5.1
- WordPress installations with any user registration enabled (Subscriber role sufficient)
Discovery Timeline
- 2026-08-05 - CVE-2026-7105 published to the National Vulnerability Database (NVD)
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-7105
Vulnerability Analysis
The vulnerability resides in the get_menu_content_editor() function within classes/class-ajax-handler.php of the Xpro Addons plugin. The function is exposed as an AJAX handler but omits a WordPress capability check such as current_user_can(). Any authenticated user, including low-privilege Subscribers, can invoke the endpoint. The handler creates a new post of the xpro_content custom post type using attacker-supplied input for the post title. Created posts are published immediately and remain queryable on the public-facing site.
This is a classic Broken Access Control issue tracked under CWE-862: Missing Authorization. The impact is limited to integrity of site content; confidentiality and availability are not directly affected.
Root Cause
The root cause is the absence of a permission check inside the AJAX handler registered by the plugin. WordPress AJAX actions registered via wp_ajax_{action} are accessible to any logged-in user by default. Without an explicit capability check, the function trusts every authenticated caller and proceeds to insert content into the database via wp_insert_post() or an equivalent call path.
Attack Vector
Exploitation requires network access to the target WordPress site and valid Subscriber-level credentials. An attacker authenticates to WordPress, obtains a valid nonce if required by the AJAX endpoint, and sends a crafted POST request to wp-admin/admin-ajax.php targeting the vulnerable action. The response contains a newly created xpro_content post with an attacker-controlled title. The post is publicly visible and indexable by search engines. Repeated requests permit bulk creation of spam content. See the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for the exact code path.
Detection Methods for CVE-2026-7105
Indicators of Compromise
- Unexpected posts of the xpro_content custom post type appearing in wp_posts with post_status = 'publish'.
- Post authorship attributed to low-privilege Subscriber accounts that would not normally publish content.
- Sudden spikes in publicly indexed URLs under the Xpro custom post type slug.
- Suspicious POST requests to /wp-admin/admin-ajax.php referencing the get_menu_content_editor action from non-administrative users.
Detection Strategies
- Query the database for xpro_content posts and correlate post_author with users lacking the edit_posts capability.
- Review web server access logs for repeated POST requests to admin-ajax.php originating from the same authenticated session or IP address.
- Enable WordPress audit logging to capture post creation events and the user role responsible.
Monitoring Recommendations
- Alert on wp_insert_post calls made by users with only the subscriber role.
- Baseline normal AJAX request volume per user role and flag deviations.
- Monitor for the creation of custom post types by unprivileged accounts across all installed plugins.
How to Mitigate CVE-2026-7105
Immediate Actions Required
- Update the Xpro Addons plugin to a version later than 1.5.1 once released by the vendor.
- Audit existing xpro_content posts and remove any that were created by non-administrative users.
- Restrict new user registration on WordPress if it is not required for site operation.
- Review and remove untrusted Subscriber accounts created during the exposure window.
Patch Information
The vendor addressed the issue in the plugin repository. Review the WordPress Plugin Changeset which introduces the required capability check in the AJAX handler. Administrators should update to the fixed release published on the WordPress plugin directory.
Workarounds
- Disable the Xpro Addons plugin until a patched version is installed.
- Deploy a Web Application Firewall (WAF) rule that blocks POST requests to admin-ajax.php with the get_menu_content_editor action from users lacking the edit_posts capability.
- Set users_can_register to false in WordPress General Settings to prevent unauthenticated account creation.
# Configuration example
# Disable open user registration via WP-CLI
wp option update users_can_register 0
# List and audit xpro_content posts created by low-privilege users
wp post list --post_type=xpro_content --fields=ID,post_title,post_author,post_status
# Temporarily deactivate the vulnerable plugin
wp plugin deactivate xpro-elementor-addons
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
