Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter

Summary

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.

Timeline

1. Oct 3, 2026, 6:38 AM UTCCVE published
2. Oct 3, 2026, 3:24 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 3, 2026, 3:42 PM UTCRecord last updated

Affected versions

• nelio Nelio Content – Editorial Calendar & Social Media Auto-Posting

  through 4.5.0

References 5