CVE-2026-7616 identifies a CSRF vulnerability in the Zawgyi Embed WordPress plugin by saturngod affecting all versions up to 2.1.1. The issue arises from missing or incorrect nonce validation on the zawgyi_adminpage function, which handles plugin settings updates. An attacker can exploit this by crafting a forged POST request to options-general.php?page=zawgyi_embed and convincing an authenticated site administrator to perform the action, resulting in unauthorized modification of the zawgyi_forceCSS setting. The vulnerability does not require privileges or direct user interaction beyond the administrator clicking a malicious link. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction and resulting in low impact on integrity only.

Successful exploitation allows an attacker to modify the zawgyi_forceCSS setting of the plugin without authentication by leveraging CSRF against an administrator. This could lead to unauthorized configuration changes but does not directly impact confidentiality or availability. There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into WordPress and consider disabling or restricting access to the Zawgyi Embed plugin settings page. Monitoring for updates from the vendor or WordPress plugin repository is recommended.