CVE-2026-8708 is a CSRF vulnerability affecting the Genzel breadcrumbs WordPress plugin up to version 1.2. The vulnerability is due to improper or absent nonce validation in the plugin's _options_page function, which manages breadcrumb configuration options such as templates, delimiter, home label, home URI, and breadcrumb rules. An attacker can exploit this by crafting a forged request that, when executed by an authenticated site administrator (e.g., via clicking a link), results in unauthorized changes to the plugin's settings. The vulnerability does not require privileges or direct authentication but relies on user interaction (UI:R). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

Successful exploitation allows an attacker to modify the breadcrumb configuration of the affected WordPress site, potentially altering navigation elements such as templates, delimiters, and labels. This could lead to misleading site navigation or user confusion but does not directly compromise confidentiality or availability. The integrity impact is low as the changes are limited to plugin configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on suspicious links and consider restricting access to the plugin's configuration page to trusted users only. Monitoring for unusual changes in breadcrumb settings may help detect exploitation attempts.