CVE-2026-1877 describes a vulnerability in the johnh10 Auto Post Scheduler WordPress plugin where the lack of nonce validation on the 'aps_options_page' function enables Cross-Site Request Forgery attacks. An attacker can exploit this by convincing an authenticated site administrator to perform an action (such as clicking a crafted link), which results in unauthorized changes to plugin settings and injection of malicious web scripts. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-site Scripting). It affects all versions up to and including 1.84.

Successful exploitation allows an attacker to update plugin settings and inject malicious scripts via forged requests executed by an authenticated administrator. This can lead to cross-site scripting attacks that compromise the confidentiality and integrity of the affected site. The availability of the site is not impacted. There are no known exploits in the wild at this time.

No official patch or fix has been published for this vulnerability as of the provided information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should avoid interacting with untrusted links or content that could trigger the vulnerability. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.