The Xpro Addons plugin for WordPress contains a missing capability check in the get_menu_content_editor() function, allowing any authenticated user who holds at least a Subscriber role to create arbitrary posts of the xpro_content custom post type. The attacker can specify any title for these posts, and the created content is publicly queryable on the site. This flaw permits data integrity violations such as content injection, SEO spam, and database pollution but does not provide direct code execution or privilege elevation. The impact is limited to integrity and availability of the site’s published content rather than confidentiality.

Any WordPress installation running Xpro Addons version 1.5.1 or earlier is affected. The plugin is known as Xpro Addons — 140+ Widgets for Elementor and is maintained by xpro. No specific WordPress core version interactions are noted, and all earlier releases up to 1.5.1 share the same flaw.

The CVSS score of 4.3 reflects a moderate severity, largely due to the limited scope of the fault and the requirement of an authenticated account. EPSS is unavailable, but the flaw is trivial to exploit once the user is authenticated: the attacker merely needs to invoke the AJAX endpoint that calls get_menu_content_editor(). The vulnerability is not listed in the CISA KEV catalog, so there are currently no known widespread active exploits, but the simple attack path means that any subscriber accounts pose a risk. Administrators should consider the base risk of allowing Subscriber role users to reach the affected endpoint, as the capability check is completely missing.