{"id":"CVE-2026-121759","kind":"vulnerability","aliases":["CVE-2026-121759"],"related":[],"title":"Fusion Page Builder WordPress plugin lets contributors trash others' posts","description":"The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash is disabled.","summary":"The Fusion Page Builder WordPress plugin before 1.7.1 does not check that a user owns the content it moves to the trash. A logged-in user with the Contributor role can trash any post or page, or delete it permanently where the trash is disabled.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-page-builder","other","wordpress"],"not_affected_if":["no-contributor-users","plugin-version-1.7.1-or-later"],"how_to_check":"- Check the installed Fusion Page Builder plugin version in the WordPress admin under Plugins; versions before `1.7.1` are affected.\n- Review which accounts hold the Contributor role or higher on the site.","fix":"- Fusion Page Builder: move to version `1.7.1` or later.","status":"open","published_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:45+00:00","updated_at":"2026-11-09T07:25:45+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-09T07:25:45Z","model":"claude-haiku-5-5","output":{"fix":"- Fusion Page Builder: move to version `1.7.1` or later.","reach":"network","title":"Fusion Page Builder WordPress plugin lets contributors trash others' posts","impact":"medium","summary":"The Fusion Page Builder WordPress plugin before 1.7.1 does not check that a user owns the content it moves to the trash. A logged-in user with the Contributor role can trash any post or page, or delete it permanently where the trash is disabled.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","fusion-page-builder"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker with Contributor role trashes or permanently deletes any post","analyst_note":"","how_to_check":"- Check the installed Fusion Page Builder plugin version in the WordPress admin under Plugins; versions before `1.7.1` are affected.\n- Review which accounts hold the Contributor role or higher on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-1.7.1-or-later","no-contributor-users"],"who_is_affected":"Sites running the Fusion Page Builder WordPress plugin before 1.7.1 that have users with Contributor or higher roles. The flaw is an authorization check on content trashing, so sites without the plugin or with no low-privilege users are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":4537,"output_tokens":523,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121759':13A,16A '-2026':12A,15A '1.7.1':30B,76C 'allow':93C 'arbitrari':104C 'builder':3A,20B,26B,72C 'check':33B,79C 'content':39B,85C 'contributor':7A,52B,101C 'could':92C 'cve':11A,14A 'delet':61B,109C 'disabl':68B,116C 'fusion':1A,18B,24B,70C 'fusion-page-build':17B 'let':6A 'log':47B 'logged-in':46B 'low':99C 'move':41B,87C 'other':9A 'own':37B,83C 'page':2A,19B,25B,59B,71C,107C 'perman':63B,111C 'plugin':5A,28B,74C 'post':10A,57B,105C 'role':53B,97C 'trash':8A,44B,55B,66B,90C,103C,114C 'user':36B,49B,82C,94C 'wordpress':4A,22B,27B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Fusion Page Builder WordPress plugin before 1.7.1 that have users with Contributor or higher roles. The flaw is an authorization check on content trashing, so sites without the plugin or with no low-privilege users are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fusionpagebuilder","medium","other","wordpress"],"campaign_type":null,"search_a":"'-121759':13A,16A '-2026':12A,15A 'builder':3A 'contributor':7A 'cve':11A,14A 'fusion':1A 'let':6A 'other':9A 'page':2A 'plugin':5A 'post':10A 'trash':8A 'wordpress':4A","search_b":"'1.7.1':30B 'builder':20B,26B 'check':33B 'content':39B 'contributor':52B 'delet':61B 'disabl':68B 'fusion':18B,24B 'fusion-page-build':17B 'log':47B 'logged-in':46B 'move':41B 'own':37B 'page':19B,25B,59B 'perman':63B 'plugin':28B 'post':57B 'role':53B 'trash':44B,55B,66B 'user':36B,49B 'wordpress':22B,27B","search_c":"'1.7.1':76C 'allow':93C 'arbitrari':104C 'builder':72C 'check':79C 'content':85C 'contributor':101C 'could':92C 'delet':109C 'disabl':116C 'fusion':70C 'low':99C 'move':87C 'own':83C 'page':71C,107C 'perman':111C 'plugin':74C 'post':105C 'role':97C 'trash':90C,103C,114C 'user':82C,94C 'wordpress':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121759","severity":null,"published_at":"2026-11-09T07:17:28+00:00","modified_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}