CVE-2026-6401 is a CSRF vulnerability in the Bottom Bar WordPress plugin by svil4ok, affecting all versions up to 0.1.7. The plugin's settings update forms lack nonce fields and server-side nonce verification, enabling unauthenticated attackers to induce logged-in administrators to unknowingly submit malicious requests that alter plugin settings such as language, post counts, or sharing services. This vulnerability stems from missing wp_nonce_field() usage in the forms and absence of check_admin_referer() calls in bottom-bar-admin.php during POST request handling.

An attacker can cause a logged-in administrator to unknowingly change plugin configuration settings, potentially impacting the integrity of the plugin's behavior. There is no direct confidentiality or availability impact reported. The exploit requires the administrator to be logged in and interact with a crafted request, limiting the attack vector to social engineering or targeted attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or sites while logged into WordPress with administrative privileges. Monitoring for plugin updates from svil4ok is recommended to apply any forthcoming patches that add nonce verification and proper request validation.