Technical impact
The Company Posts for LinkedIn plugin for WordPress contains a missing capability check on the function that resets LinkedIn post data. As a result, any authenticated user with Subscriber or higher access can trigger the reset action and remove all LinkedIn post information stored in the site's options table. This weakness falls under Missing Authorization, allowing an attacker to delete stored data that may be important for the site's LinkedIn integration.
Affected Systems
All installations of the Company Posts for LinkedIn plugin by brainstation23 running version 1.0.0 or earlier are affected. Users who have engaged the plugin on their WordPress sites and configured LinkedIn posting are at risk. No specific WordPress core version is implicated; the issue resides entirely within the plugin.
Risk and Exploitability
The CVSS score is 4.3, indicating moderate risk. Because the vulnerability requires an authenticated user, an attacker must already have legitimate access to the WordPress administrative interface with at least Subscriber level privileges. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation data. Nonetheless, the ability to delete stored LinkedIn post data can disrupt automated posting and impact a site’s LinkedIn presence; therefore organizations should treat this as a patchable concern.
