The vulnerability arises because the Testimonials Widget WordPress plugin does not enforce a capability or ownership check when processing its public testimonial submission form. This oversight permits any unauthenticated user to submit data that overwrites the title, content, and author of existing posts, or to create new posts. The weakness maps to improper access control, allowing an attacker to tamper with site content and destroy trust in the authenticity of displayed testimonials.

WordPress sites that have the Testimonials Widget plugin installed with a version equal to or earlier than 4.0.4. No further version granularity is provided; the vulnerability exists across all affected releases of the plugin up to and including 4.0.4.

Because the flaw exists in a readily accessible front‑end form, it can be exploited by anyone with access to the site’s URLs, regardless of login status. The attack does not require prior knowledge of the site’s admin credentials or detailed technical setup. The vulnerability is not yet listed in CISA KEV, and the EPSS score is <1%, but the lack of authentication control, combined with a high CVSS score of 7.5, makes it a significant risk for content integrity and potential reputational damage.