A critical vulnerability in the BE REST Endpoints plugin allows unauthenticated attackers to perform unauthorized administrative actions and execute arbitrary scripts on the site.

This vulnerability consists of a missing authorization check and a lack of input sanitization, which permits unauthenticated users to read, create, update, or delete widgets and inject malicious scripts.

The ability for unauthenticated users to inject arbitrary web scripts poses a severe risk to site integrity and visitor security. Successful exploitation could lead to full site compromise, unauthorized administrative actions, or the redirection of site visitors to malicious domains, which significantly damages user trust and brand reputation. With a CVSS score of 8.8, this flaw is categorized as high severity due to its potential for total impact.

Immediate Action: As no official patch is currently available, administrators should immediately deactivate and uninstall the BE REST Endpoints plugin from all WordPress instances until a secure version is released.

Proactive Monitoring: Security teams should monitor server access logs for suspicious REST API requests originating from unauthorized sources targeting widget endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious script injections and restrict unauthorized access to the WordPress REST API endpoints.

Public Exploit Available: No (no confirmed public exploit)

Given the high CVSS score and the ease with which unauthenticated actors can manipulate widget data, immediate removal of the affected plugin is the only effective mitigation at this time. Organizations should prioritize identifying all instances of this plugin within their environment and ensure that administrative access to the REST API is restricted by default. Failure to act promptly leaves the site vulnerable to persistent cross-site scripting attacks that impact all visiting users.