CVE-2026-7561 is a Cross-Site Request Forgery vulnerability in the Tm – WordPress Redirection plugin for WordPress, affecting all versions up to and including 1.2. The issue arises from missing or incorrect nonce validation on a function, enabling attackers to craft forged requests that, if executed by an authenticated site administrator, can update plugin settings or inject malicious web scripts. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No patch or official fix has been published by the vendor as of the latest information.

Successful exploitation allows an attacker to perform unauthorized changes to plugin settings and potentially inject malicious scripts by leveraging a site administrator's interaction with a crafted request. This can lead to partial confidentiality and integrity loss within the affected WordPress site. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution with links and requests that could trigger plugin actions and consider limiting administrative access or employing additional security controls such as Web Application Firewalls that can detect and block CSRF attempts. Monitor official vendor channels for updates regarding patches or mitigations.