The LLM Hubspot Blog Import plugin for WordPress contains a missing capability check on the 'process_save_blogs' AJAX endpoint in all releases up to and including 1.0.1. As a result, any authenticated user with the Subscriber role or higher can invoke the endpoint and trigger the import of all Hubspot data. This flaw allows attackers to alter blog content, potentially deleting or modifying posts, without proper authorization.

Affected systems are WordPress installations that have the Limelightmarketing LLM Hubspot Blog Import plugin installed at versions 1.0.1 or earlier. The issue applies to all WordPress environments that use the plugin and where subscribers are granted the ability to interact with the AJAX endpoint. The plugin is identified by the vendor Limelightmarketing and the product LLM Hubspot Blog Import.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. Although the flaw does not enable remote code execution, the impact on data integrity is significant because any logged‑in user can trigger a full re‑import and overwrite existing blog content. The vulnerability is not listed in CISA's KEV catalog, further indicating the exploit community has not widely leveraged this flaw yet. Prior to a patch, an attacker only needs a valid authenticated session with Subscriber level or higher; no special network exposure is required.