CVE-2026-7561 is a CSRF vulnerability in the Tm – WordPress Redirection plugin for WordPress, affecting all versions up to 1.2. The issue arises from missing or incorrect nonce validation on a function, enabling attackers to perform unauthorized state-changing actions by tricking authenticated administrators into submitting forged requests. This can lead to unauthorized updates of plugin settings and injection of malicious web scripts. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

An attacker can exploit this vulnerability to cause an authenticated administrator to unknowingly perform actions that modify plugin settings or inject malicious scripts. This can compromise the integrity and confidentiality of the affected WordPress site. However, exploitation requires user interaction (administrator clicking a crafted link), and no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with untrusted links and consider restricting administrative access or implementing additional CSRF protections at the site level.