CVE-2026-7047 describes a CSRF vulnerability in the Frontend User Notes WordPress plugin versions up to and including 2.1.1. The vulnerability arises from missing or incorrect nonce validation on the funp_ajax_modify_notes function, enabling unauthenticated attackers to coerce logged-in users into submitting forged requests that modify their own notes via wp_update_post(). Ownership enforcement restricts modifications to notes owned by the victim user, preventing cross-user note alteration.

An attacker can cause a logged-in user to unknowingly overwrite their own note content by tricking them into visiting a malicious page. This results in unauthorized modification of the victim's notes but does not allow modification of notes owned by other users. There is no impact on confidentiality or availability, only limited integrity impact on the victim's own notes.

No official patch or fix is currently available. Users should monitor the vendor advisory for updates. Until a fix is released, administrators should be cautious about clicking on untrusted links while logged in and consider restricting access to the plugin or disabling it if possible to reduce risk.