Authorization bypass in Smart Post
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-639.
Summary
The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Smart Post | 4.0.0 to before 4.0.8 | 4.0.8 | Patch available | CNA |
- Smart Post VendorUnknown Affected 4.0.0 to before 4.0.8 Fixed in 4.0.8 Patch available CNA
Remediation
- Fix · CNA Smart Post (Unknown) Fixed in 4.0.8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Smart Post 4.0.8
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-54351 Information disclosure in Smart PostPriority LOW 30
Timeline
- 2026-10-02 Threatist record created from CVE-2026-78150
- 2026-10-03 Alias added: GHSA-258v-5wmv-8454
References
Sources
- CVE-2026-78150 · CVE Program
- CVE-2026-78150 · NVD
- FIRST EPSS
- GHSA-258v-5wmv-8454 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences