CVE-2026-1208 describes a Cross-Site Request Forgery vulnerability in the Friendly Functions for Welcart plugin for WordPress. The issue arises from missing or incorrect nonce validation on the plugin's settings page, which enables attackers to craft malicious requests that, when executed by an authenticated administrator, can update plugin settings without proper authorization. This vulnerability affects all versions up to and including 1.2.5. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction.

An attacker can cause an authenticated site administrator to unknowingly modify plugin settings by tricking them into clicking a malicious link or visiting a crafted webpage. This can lead to unauthorized changes in the plugin configuration, potentially affecting site behavior or security. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or websites. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.