CVE-2026-8906 is a Cross-Site Request Forgery (CWE-352) vulnerability in the WP Promoter plugin for WordPress, affecting all versions up to and including 1.3. The issue arises from missing or incorrect nonce validation on a function, which enables attackers to forge requests that cause site administrators to unknowingly update settings or inject malicious web scripts. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation could allow an attacker to update plugin settings and inject malicious scripts by tricking an administrator into executing a forged request. This can lead to partial compromise of site integrity and confidentiality. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution with links and requests that could trigger plugin settings changes. Monitoring for updates from the plugin author or WordPress security advisories is recommended.