Security Alert Summary
The Guest posting / Frontend Posting / Front Editor WordPress plugin contains a vulnerability that allows an unauthenticated attacker to trigger generation and download of a .json file containing demo form data. If an administrator modified the demo form and enabled admin notifications in the plugin settings, the exported data can include sensitive configuration and the administrator’s email address.
CVE Details
- CVE ID: CVE-2026-1867
- Affected plugin / component: Guest posting / Frontend Posting / Front Editor WordPress plugin (as described in the CVE)
- Affected versions: Versions before 5.0.6 (as stated in the CVE)
- Published: March 11, 2026 at 06:17:13 AM UTC
- Last modified: March 11, 2026 at 02:16:17 PM UTC
- CVSS v3.1: Base Score 5.9 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack Vector: NETWORK
- Attack Complexity: HIGH
- Privileges Required: NONE
- User Interaction: NONE
- Scope: UNCHANGED
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- CWE / weakness: CWE-200 (Information Exposure)
Technical Details
According to the CVE description, the plugin provides a mechanism that can regenerate a .json file based on demo data it initially creates. This regeneration can be triggered via a URL parameter. When an administrator has modified the demo form and enabled admin notifications in the plugin’s settings, the generated .json export can include form data and configuration values, including the administrator’s email address.
The root cause is an information exposure vector where demo/export functionality can be invoked without authentication and returns sensitive configuration data. The CVE does not name specific PHP functions or REST endpoints; it describes the issue as being triggered by a URL parameter that regenerates and allows downloading the .json file containing demo data.
The impact is limited to disclosure of data contained in that exported .json (for example, form fields, settings, and admin email addresses). The CVE does not describe modification or remote code execution — the primary concern is unauthorized access to exported configuration and contact information.
How This Could Impact Your Website
In a typical small-business WordPress site, the site owner or an administrator configures a frontend form for guest submissions. Internal staff or external contributors may use or update that form. If an administrator adjusted the demo form and enabled admin notifications, an unauthenticated visitor could trigger the .json export and download the file containing the form settings and the administrator’s email address.
Practical consequences include exposure of internal or administrative email addresses, which can increase the risk of targeted phishing or social engineering against staff and administrators. The disclosure does not, based on the CVE details, indicate direct site takeover, but exposed contact information can be used in follow-up attacks.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and privileges, especially contributor-level or higher accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior such as unexpected file downloads or access to demo/export endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
