CVE-2026-7105 xpro CVE debrief

Who should care

WordPress users with Xpro Addons plugin installed should prioritize updating to a patched version to prevent exploitation. Security teams monitoring for content injection and SEO spam should also be aware of this vulnerability and review their current configurations to ensure they are protected. Additionally, operators of WordPress platforms and vulnerability management teams should assess their exposure and implement necessary mitigations.

Technical summary

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles.

Defensive priority

Authenticated attackers with Subscriber-level access can create arbitrary published posts, enabling content injection and SEO spam.

Recommended defensive actions

• Inventory and verify Xpro Addons plugin version
• Restrict Subscriber-level access and above
• Monitor for suspicious post creations
• Implement compensating controls for content injection
• Review official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows creation of arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. These posts are publicly queryable on the front-end. The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution. To verify, defenders should review the plugin version, check for suspicious post creations, and implement compensating controls for content injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.