CVE-2026-1393 is a Cross-Site Request Forgery (CWE-352) vulnerability affecting the Add Google Social Profiles to Knowledge Graph Box WordPress plugin in all versions up to and including 1.0. The issue arises from missing nonce validation on the plugin's settings update functionality, enabling unauthenticated attackers to update plugin settings if they can trick an administrator into clicking a crafted link. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and requiring user interaction.

An attacker can cause a site administrator to unknowingly modify the plugin's Knowledge Graph settings via a forged request. This could lead to unauthorized changes in the plugin configuration, potentially affecting site behavior or data presentation. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when clicking links and consider disabling or removing the plugin if feasible. Monitoring for updates from the vendor or plugin author is recommended to apply any forthcoming patches promptly.