CVE-2026-6701 is a CSRF vulnerability in the kazunii addfreespace WordPress plugin versions up to 0.1.3. The issue arises from missing or incorrect nonce validation on a function that handles settings updates. This allows an attacker to craft a forged request that, if executed by a site administrator, could modify plugin settings and inject malicious web scripts. The vulnerability is remotely exploitable without authentication but requires user interaction (UI:R). The CVSS 3.1 base score is 4.3, reflecting limited impact on confidentiality and integrity with no impact on availability.

Successful exploitation could lead to unauthorized modification of plugin settings and injection of malicious scripts, potentially compromising the integrity of the affected WordPress site. However, the attack requires tricking an administrator into performing an action, and there is no direct impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with unsolicited links and consider disabling or removing the addfreespace plugin if it is not essential. Monitoring for updates from the vendor or security advisories is recommended.