CVE-2026-7615 is a Cross-Site Request Forgery vulnerability in the kasparsd Widget Context WordPress plugin. The issue arises from missing or incorrect nonce validation on the save_widget_context_settings function, enabling unauthenticated attackers to modify widget visibility context settings stored in the WordPress options table. Exploitation requires tricking a site administrator into performing an action such as clicking a malicious link that triggers a forged POST request to /wp-admin/widgets.php. The vulnerability affects all versions up to and including 1.3.3. No patch or official fix has been documented in the provided data.

An attacker can modify widget visibility context settings without proper authorization by exploiting the CSRF vulnerability. This could lead to unauthorized changes in the website's widget configuration, potentially affecting site behavior or appearance. There is no indication of confidentiality or availability impact. Known exploits in the wild have not been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links or performing actions in the WordPress admin interface, especially from untrusted sources. Monitoring for updates from the kasparsd plugin vendor is recommended.