CVE-2026-1916: 
WordPress vulnerability analysis and mitigation

CVE-2026-1916 is a Missing Authorization vulnerability in the WPGSI: Spreadsheet Integration plugin for WordPress that allows unauthenticated attackers to create, modify, and delete arbitrary WordPress posts and pages. The flaw affects all versions of the plugin up to and including 3.8.3. It was published on February 25, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization) and stems from two root causes in the plugin's REST API implementation. The wpgsi_callBackFuncAccept and wpgsi_callBackFuncUpdate REST API endpoints are registered with permission_callback => '__return_true', granting unauthenticated network access to any caller. The plugin's secondary defense — a custom token-based validation — relies on a Base64-encoded JSON object containing the user ID and email address, but this token is not cryptographically signed, making it trivially forgeable by any attacker who can enumerate the administrator's user ID and email address. Exploitation additionally requires knowledge of an active integration ID with remote updates enabled (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated remote attackers to create, modify, or delete arbitrary WordPress posts and pages, resulting in a high integrity impact with no confidentiality or availability impact. Attackers could deface website content, inject malicious links or scripts into pages, or destroy critical site content. The scope is limited to the affected WordPress installation, but content manipulation could serve as a stepping stone for social engineering or supply-chain attacks targeting site visitors (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.097%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and only publicly enumerable information (admin user ID and email), lowering the practical barrier for exploitation against sites where this information is discoverable (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the WPGSI: Spreadsheet Integration plugin (version ≤ 3.8.3) using tools like WPScan or by checking /wp-content/plugins/wpgsi/ for plugin presence.
2. Enumerate admin information: Obtain the administrator's user ID (typically 1) and email address via the WordPress REST API (/wp-json/wp/v2/users) or other public enumeration techniques (e.g., author archive pages).
3. Identify active integration ID: Probe or guess an active integration ID that has remote updates enabled, which may be discoverable through site behavior or brute-forcing.
4. Forge authentication token: Construct a Base64-encoded JSON object containing the admin user ID and email (e.g., base64_encode(json_encode(['user_id' => 1, 'email' => 'admin@example.com']))) to create a forged token.
5. Send malicious REST API request: Submit an unauthenticated HTTP POST request to the vulnerable REST endpoint (wpgsi_callBackFuncAccept or wpgsi_callBackFuncUpdate) with the forged token and a payload to create, modify, or delete WordPress posts or pages.
6. Achieve objective: Confirm content modification, defacement, or deletion on the target WordPress site (Wordfence, WordPress Trac).

• Network: Unauthenticated HTTP POST requests to WordPress REST API endpoints associated with the WPGSI plugin (e.g., paths containing wpgsi_callBackFuncAccept or wpgsi_callBackFuncUpdate) from unexpected or unknown IP addresses.
• Logs: WordPress access logs showing REST API calls to WPGSI endpoints without valid session cookies or nonces; repeated requests with Base64-encoded tokens in request bodies or headers.
• File System: Unexpected modifications to WordPress post/page content in the database, particularly bulk changes or deletions not attributable to authenticated admin activity.
• Application: Sudden appearance of new posts or pages, or unexplained edits to existing content, especially if the site uses the WPGSI plugin with remote update integrations enabled.

Users should update the WPGSI: Spreadsheet Integration plugin to a version beyond 3.8.3 that addresses the missing authorization and insecure token validation issues. The patch was committed to the plugin's trunk (WordPress Trac Changeset). As an interim workaround, site administrators should disable any active integrations with remote updates enabled, or deactivate the plugin entirely until a patched version is installed. Additionally, restricting public enumeration of admin user IDs and email addresses (e.g., disabling the /wp-json/wp/v2/users endpoint) reduces the attacker's ability to forge tokens (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the initial advisory. It received coverage from security aggregators including Vulners, InfinitSec, and RedPacketSecurity on Mastodon shortly after disclosure. Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published alerts. Community reaction was limited, consistent with the moderate severity and niche plugin scope (Wordfence, InfinitSec).