The WPGSI: Spreadsheet Integration plugin for WordPress contains missing authorization checks on two REST API endpoints, allowing any request to execute because the permission callback always returns true. The plug‑in uses a Base64‑encoded JSON token that carries the user ID and email address without cryptographic signing, making the token easily forgeable. As a result, an unauthenticated attacker who knows an administrator’s email address and an active integration ID can create, modify, or delete arbitrary WordPress posts and pages, severely compromising content integrity and data loss.

All installations of the javmah WPGSI: Spreadsheet Integration plugin up to and including version 3.8.3 are vulnerable. The issue spans the entire WordPress ecosystem wherever this plugin is deployed, affecting sites that allow remote updates through the plugin’s integration feature.

The overall risk is moderate to high, with a CVSS 3.1 score of 7.5. The EPSS score is below 1%, indicating a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Because the vulnerability is exploitable via unauthenticated REST API calls, an attacker only needs to identify an admin email and an active integration ID, and then can forge a token to perform arbitrary content operations. The lack of cryptographic signing and missing capability checks make the attack straightforward once the prerequisites are met.