The Easy Post Submission plugin for WordPress permits unauthenticated users to alter key attributes of existing posts because the AJAX action rbsm_submit_post lacks a required capability check. An attacker can change a post’s title, content, excerpt, categories, tags, and even move it to draft status using a supplied postId. This flaw, identified as CWE‑862, carries a CVSS score of 9.1, signalling a highly severe risk that could result in defacement, censorship, or unauthorized redistribution of content.

The vulnerability affects the Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content WordPress plugin in all releases up to and including version 2.3.0. No other products are listed as affected.

The EPSS score is not provided and the issue is not in the CISA KEV catalog, yet the high CVSS rating underlines its threat level. Based on the description, it is inferred that the attack vector is unauthenticated AJAX requests sent to the wp_ajax_nopriv_rbsm_submit_post endpoint with a postId parameter, which bypasses any authentication checks. Exploitation requires only an HTTP request and no privileged access, making it an accessible threat for attackers.