CVE-2026-8939 is a CSRF vulnerability in the Search Simple Fields plugin for WordPress, present in versions up to 0.2. The issue arises from missing or incorrect nonce validation in the search_simple_fields_options() function within functions_admin.php. This allows unauthenticated attackers to modify plugin settings by tricking an administrator into performing an action such as clicking a malicious link. The vulnerability impacts the integrity of plugin configuration but does not affect confidentiality or availability. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can modify the plugin's settings without authentication by exploiting the CSRF vulnerability, potentially altering which post types, custom fields, and media fields are searched. This could lead to unintended behavior or exposure of data depending on how the plugin is used. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links and consider limiting administrative access or using additional CSRF protections at the WordPress or server level. Monitor official channels for updates or patches from the plugin developer.