🔐 CVE Alert

CVE-2026-94505

HIGH 8.1

Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter

CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.

CWE CWE-862
Vendor nelio
Product nelio content – editorial calendar & social media auto-posting
Published Oct 3, 2026
Stay Ahead of the Next One

Get instant alerts for nelio nelio content – editorial calendar & social media auto-posting

Be the first to know when new high vulnerabilities affecting nelio nelio content – editorial calendar & social media auto-posting are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

nelio / Nelio Content – Editorial Calendar & Social Media Auto-Posting
0 ≤ 4.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/828050ce-4775-4256-8dcf-2cdb96d5ec4e?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/nelio-content/tags/4.5.0/includes/post-types/reusable-messages/class-nelio-content-reusable-message-rest-controller.php#L68 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/nelio-content/tags/4.5.0/includes/post-types/reusable-messages/class-nelio-content-reusable-message-rest-controller.php#L169 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/nelio-content/tags/4.5.0/includes/utils/functions/helpers.php#L80 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3724505/nelio-content/tags/4.5.1

Credits

Wordfence PRISM