CVE-2026-121759 · Other
NO FIX YET · SEE WHAT TO DO
The Fusion Page Builder WordPress plugin before 1.7.1 does not check that a user owns the content it moves to the trash. A logged-in user with the Contributor role can trash any post or page, or delete it permanently where the trash is disabled.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Fusion Page Builder WordPress plugin before 1.7.1 that have users with Contributor or higher roles. The flaw is an authorization check on content trashing, so sites without the plugin or with no low-privilege users are not exposed.
Not affected if no-contributor-users, plugin-version-1.7.1-or-later
Who cares fusion-page-builder, wordpress
1.7.1 are affected.1.7.1 or later.The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash is disabled.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.