The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Contentstudio Plugin | — | Update contentstudio plugin to version 1.2.6, or a newer patched version | May 15, 2025 | Jan 6, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub