CVE-2026-1916 Details
Description
The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks and an insecure authentication mechanism on the `wpgsi_callBackFuncAccept` and `wpgsi_callBackFuncUpdate` REST API functions in all versions up to, and including, 3.8.3. Both REST endpoints use `permission_callback => '__return_true'`, allowing unauthenticated access. The plugin's custom token-based validation relies on a Base64-encoded JSON object containing the user ID and email address, but is not cryptographically signed. This makes it possible for unauthenticated attackers to forge tokens using publicly enumerable information (admin user ID and email) to create, modify, and delete arbitrary WordPress posts and pages, granted they know the administrator's email address and an active integration ID with remote updates enabled.
A vulnerability in the WPGSI: Spreadsheet Integration plugin for WordPress allows unauthorized users to modify and delete data. This issue arises from inadequate capability checks and a flawed authentication process in the `wpgsi_callBackFuncAccept` and `wpgsi_callBackFuncUpdate` REST API functions, affecting all versions up to and including 3.8.3. Both endpoints grant unauthenticated access by using `permission_callback => '__return_true'`, and the plugin's custom token validation is based on a Base64-encoded JSON object containing the user ID and email, which is not cryptographically signed. As a result, attackers can forge tokens with publicly available information (admin user ID and email) to create, update, or delete any WordPress posts or pages, provided they have the administrator's email and an active integration ID with remote updates enabled.
Users can update to WPGSI: Spreadsheet Integration version 3.8.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 25, 2026CISA-ADP
Assessed Feb 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WPGSI: Spreadsheet Integration | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | New CVE Received | [email protected] |