CVE-2026-24957
📋 TL;DR
This CVE describes a missing authorization vulnerability in the Strong Testimonials WordPress plugin that allows attackers to bypass access controls. It affects WordPress sites running Strong Testimonials version 3.2.20 or earlier, potentially allowing unauthorized users to perform actions reserved for authenticated users.
💻 Affected Systems
- WordPress Strong Testimonials Plugin
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify or delete testimonials, inject malicious content, or potentially escalate privileges to gain administrative access to the WordPress site.
Likely Case
Unauthorized users could add, edit, or delete testimonials without proper authentication, potentially defacing the website or posting malicious content.
If Mitigated
With proper access controls and authentication mechanisms in place, only authorized users can manage testimonials as intended.
🎯 Exploit Status
The vulnerability involves broken access control which typically requires minimal technical skill to exploit once discovered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.21 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Strong Testimonials and click 'Update Now'. 4. Alternatively, download version 3.2.21+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable Strong Testimonials Plugin
allTemporarily deactivate the plugin until patched
wp plugin deactivate strong-testimonials
Restrict Plugin Access via .htaccess
linuxAdd access restrictions to plugin directories
Order Deny,Allow
Deny from all
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block unauthorized access to testimonial management endpoints.
- Enable WordPress security plugins that monitor and block suspicious access patterns to admin functions.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Strong Testimonials version numberCheck Version:
wp plugin get strong-testimonials --field=versionVerify Fix Applied:
Verify plugin version is 3.2.21 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to /wp-admin/admin-ajax.php with testimonial-related actions
- Multiple failed authentication attempts followed by successful testimonial modifications
Network Indicators:
- Unusual traffic patterns to testimonial management endpoints from unauthenticated IPs
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php" AND action="wpmtst_*") AND NOT user_authenticated=true