The User Submitted Posts plugin for WordPress fails to validate user‑supplied category identifiers against the administrator‑configured allowed list. As a result, anyone can supply arbitrary category IDs in a crafted POST request and force posts to be assigned to restricted or otherwise disallowed categories. The flaw does not provide direct code execution or database disclosure, but it undermines content integrity, enabling stealthy publication or defacement within protected sections.

WordPress sites that use any version of the User Submitted Posts – Enable Users to Submit Posts from the Front End plugin up to and including release 20260113. The affected component is the front‑end submission handler that processes the 'user-submitted-category[]' field.

The CVSS v3.1 score of 5.3 signals moderate severity. The EPSS score is below 1%, indicating a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending a direct HTTP POST containing crafted 'user-submitted-category[]' values to the plugin’s category retrieval endpoint. Because the flaw is purely an authorization issue that can be exercised without authentication, the exploitation pathway is straightforward but currently rarely observed.