Nelio Content WordPress plugin: Missing authorization allows deletion of reusable messages
Summary
The Nelio Content plugin for WordPress does not verify whether a user is authorized to delete reusable social messages (nc_reusable_social posts). An authenticated attacker with Contributor rights or higher can permanently delete messages created by administrators or other privileged users. The vulnerability affects integrity and availability (content deletion); no confidentiality impact is listed in the vector.
Affected
- Nelio Content plugin for WordPress, versions up to and including 4.5.0
- Default configuration: unaffected per CNA record (vendor data pending in NVD)
Fixed in
- Version 4.5.1 (changelog dated 2 October 2026: "Fix authorization checks when editing or deleting reusable social messages")
Workaround
- No vendor-published workaround.
- Review accounts with Contributor or higher roles and remove those that are not needed.
- Back up reusable social message content so deletions can be recovered.
Exploitation
- Public proof of concept: none confirmed in the sources checked.
- Not listed in the CISA Known Exploited Vulnerabilities catalog according to a secondary source; not independently verified.
- CISA SSVC: Exploitation none, Automatable no, Technical impact partial.
- CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
Our recommendation
- Update the Nelio Content plugin to version 4.5.1 or later promptly.
- Check which accounts have Contributor or higher roles and remove unneeded ones.
- Back up reusable social message content regularly.
- Monitor for unexpected deletions of social message content.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- Plugin changeset 3724505 (tag 4.5.1) plugins.trac.wordpress.org
- Vulnerable REST controller, tag 4.5.0 (L169) plugins.trac.wordpress.org
- Vulnerable REST controller, tag 4.5.0 (L68) plugins.trac.wordpress.org
- Helper functions, tag 4.5.0 (L80) plugins.trac.wordpress.org
- WordPress.org plugin page (changelog) wordpress.org
- Strix CVE record www.strix.ai
- Positive Technologies advisory PT-2026-104548 (via Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:56.
Original description (NVD)
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
NVD references (5)
- https://plugins.trac.wordpress.org/browser/nelio-content/tags/4.5.0/includes/post-types/reusable-messages/cla…
- https://plugins.trac.wordpress.org/browser/nelio-content/tags/4.5.0/includes/post-types/reusable-messages/cla…
- https://plugins.trac.wordpress.org/browser/nelio-content/tags/4.5.0/includes/utils/functions/helpers.php#L80
- https://plugins.trac.wordpress.org/changeset/3724505/nelio-content/tags/4.5.1
- https://www.wordfence.com/threat-intel/vulnerabilities/id/828050ce-4775-4256-8dcf-2cdb96d5ec4e?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.