CVE-2026-1081 identifies a CSRF vulnerability in the Set Bulk Post Categories plugin for WordPress, affecting all versions up to 1.1. The vulnerability arises from the absence of nonce validation on the bulk category update functionality, enabling attackers to forge requests that modify post categories without proper authorization. Exploitation requires social engineering to induce an administrator to execute the malicious request. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low complexity and no required privileges but user interaction is necessary.

An attacker can cause unauthorized bulk modification of post categories by tricking an administrator into executing a crafted request. This can lead to integrity issues in content categorization but does not impact confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with untrusted links and consider disabling or restricting the use of the affected plugin. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.