Technical impact
The Frontend Post Submission Manager Lite plugin allows an unauthenticated user to modify existing WordPress posts by sending a post_id parameter through the guest posting form, bypassing any authorization checks. This flaw enables the attacker to change titles, content, excerpts, and remove the post author, thereby compromising the integrity of site content. The vulnerability is categorized under CWE‑862 and presents a functional violation of access control rather than a code execution risk.
Affected Systems
All installations of the WordPress Frontend Post Submission Manager Lite plugin up to and including version 1.2.5 are affected. The issue exists in the ajax-process-form.php file that handles the fpsml_form_process action for all users, including guests.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate risk, but the EPSS score of less than 1% suggests that exploitation is presently uncommon. The flaw is not listed in CISA's KEV catalog. The attack vector appears to be the publicly accessible AJAX endpoint, requiring no authentication but allowing arbitrary post modification when a valid post ID is supplied. The overall risk is moderate with low exploitation probability, yet the integrity of content is directly impacted.
