CVE-2026-6396 describes a CSRF vulnerability in the Fast & Fancy Filter – 3F WordPress plugin (up to version 1.2.2). The issue arises because the saveFields() function, which handles the fff_save_settins AJAX action, lacks nonce verification. This missing security check enables attackers to perform unauthorized changes to plugin settings or create filter posts by tricking authenticated administrators into submitting forged requests. The vulnerability is rated medium severity with a CVSS 3.1 score of 4.3 and does not require privileges but does require user interaction (UI:R). No patch or official fix has been documented yet.

An attacker can cause an authenticated administrator to unknowingly modify plugin filter settings, update arbitrary options, or create new filter posts via CSRF attacks. This could lead to unauthorized configuration changes within the plugin, potentially affecting site behavior or content. There is no direct confidentiality or availability impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Implementing general CSRF protections such as nonce verification in custom code or using security plugins that add CSRF defenses may help mitigate risk.