CVE-2026-11775 describes a CSRF vulnerability in the User Admin Simplifier plugin for WordPress, affecting all versions up to and including 3.0.0. The vulnerability is caused by missing or incorrect nonce validation in the useradminsimplifier_options_page function. Exploitation allows an attacker to forge requests that trigger uas_save_admin_options(), overwriting the useradminsimplifier_options database entry. This can reset and permanently delete any user's stored menu and admin-bar configuration if a site administrator is tricked into clicking a malicious link. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and no privileges required but requiring user interaction.

An attacker can cause a site administrator to unknowingly reset and delete stored menu and admin-bar configurations for any user by exploiting the CSRF vulnerability. This results in loss of personalized admin interface settings but does not impact confidentiality or availability. The impact is limited to integrity of user interface configuration data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.