CVE-2026-1070 describes a CSRF vulnerability in the Alex User Counter WordPress plugin (versions up to 6.0). The issue arises from the lack of nonce validation in the alex_user_counter_function(), enabling attackers to forge requests that update plugin settings without proper authorization. Exploitation requires social engineering to induce an administrator to perform an action such as clicking a crafted link. The vulnerability is rated medium severity (CVSS 4.3) and does not impact confidentiality or availability but can cause limited integrity loss by altering plugin settings.

An attacker can cause unauthorized changes to the plugin settings by exploiting the CSRF vulnerability if an administrator is tricked into clicking a malicious link. This does not directly compromise data confidentiality or availability but can lead to unauthorized configuration changes, potentially affecting site behavior or security posture.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider disabling or replacing the plugin if possible. Implementing additional CSRF protections at the site level may help mitigate risk.