Broken Access Control in Inseri Core (WordPress Plugin)

Plugin: Inseri Core
Affected Component: /includes/rest_api.php
Vulnerability Type: Broken Access Control (Missing Authorization)
Status: Reported in August 2026– Closed as Duplicate.

---

Summary

Whilst testing this summer I came across a Broken Access Control vulnerability was identified in the Inseri Core WordPress plugin.

The plugin exposes a REST API endpoint used by the “Export” button that allows downloading an archive of a post/page. This endpoint does not properly verify the current user’s capabilities or the publication status of the content.

As a result, an unauthenticated (or low-privileged) user can download the archive of a post even when the post has been set to Draft or Deleted.

---

Steps to Reproduce

1. Install and activate the Inseri Core plugin.
2. Create a page/post while logged in as a user that has access to the Inseri interface.
3. Insert the Inseri button to Export onto your page.
4. Preview the page and click intercept once you initiate the download / export request (see method below).
5. Note the REST endpoint that is called (in my case it was : http://localhost:8080/index.php?rest_route=/inseri-core/v1/archive/2)
6. Change the post status of the page in wordpress to Draft or permanently delete the post.
7. Re-request the same endpoint (e.g. with curl or a browser); the archive still remains availavble for download.

Result: The archive is still returned successfully.

---