CyberRota Analysis
AI-GeneratedThe Xpro Addons plugin for WordPress is vulnerable due to a lack of capability checks in the `get_menu_content_editor()` function, allowing authenticated users with Subscriber-level access or higher to create arbitrary posts of the `xpro_content` custom post type. This vulnerability can lead to content injection, SEO spam, and database pollution, as the created posts are publicly accessible. WordPress site administrators using the affected plugin should prioritize applying updates to mitigate potential exploitation.
Original NVD Description
The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution.