CVE-2026-4071 describes a CSRF vulnerability in the BirdSeed WordPress plugin affecting all versions up to 2.2.0. The vulnerability is due to the lack of nonce validation in the birdseed_plugin_settings_page() function. This function accepts a 'birdseed_token' parameter via GET and updates the plugin's token setting in the database without verifying the request's origin or intent. Consequently, an unauthenticated attacker can cause an administrator to unknowingly change the plugin's token by tricking them into clicking a malicious link or performing a crafted request.

An attacker can modify the BirdSeed token setting without authentication by exploiting the CSRF vulnerability. This could lead to unauthorized changes in plugin configuration, potentially impacting the plugin's intended functionality or security posture. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into WordPress and consider restricting access to the plugin settings page. Implementing manual nonce validation or other CSRF protections in the plugin code can mitigate the risk.