A Cross-Site Request Forgery (CSRF) vulnerability exists in the Google Authenticator WordPress plugin versions before 0.56. The plugin does not verify a CSRF nonce when saving the two-factor authentication setup, allowing an attacker to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value. This can enable the attacker to lock the victim out of their account by enabling two-factor authentication with the attacker's secret.
PeproDev WooCommerce Receipt Uploader WordPress plugin versions up to and including 2.8.0 are vulnerable to an authorization bypass vulnerability. This flaw allows unauthenticated users to perform write operations due to missing authorization checks, specifically an IDOR (Insecure Direct Object Reference) issue. The vulnerability requires WooCommerce to be installed and can lead to unauthorized modification of data without authentication.
CVE-2026-66885 is a Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook when configured with Livebook Teams for identity. An attacker in the same Livebook Teams organization can cause a victim's browser session to authenticate as the attacker by tricking the victim into using a crafted URL with an authorization code. This results in the victim unknowingly operating under the attacker's identity, exposing any work or secrets to the attacker. The vulnerability affects livebook versions from 0.15.0 before 0.18.7 and from 0.19.0 before 0.19.9. The CVSS 4.0 score is 6.8 (medium severity).
CVE-2026-7326 is a cross-site request forgery (CSRF) vulnerability in the Admin UI of Progress MarkLogic Server versions before 11.3.6 and 12.0.3. It allows a remote attacker to trick an authenticated administrator into performing unintended administrative actions by visiting a malicious web page. This can lead to unauthorized changes in security configurations. The vulnerability has a high severity with a CVSS score of 7.5.
OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.
Eclipse Theia versions up to and including 1.73.1 have a vulnerability in the @theia/filesystem backend where an unauthenticated attacker can perform arbitrary file writes outside the workspace via a specially crafted POST /file-upload request. This occurs because the handler accepts an absolute path from user input without workspace confinement or authentication. Browser deployments are affected due to insufficient token enforcement on HTTP requests, enabling cross-origin web pages to exploit this without credentials. Electron mode is not affected by this issue. The vulnerability has a high severity CVSS score of 8.8 and can lead to remote code execution by overwriting critical files such as ~/.bashrc.
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
The Search Analytics for WP WordPress plugin up to version 1.4.16 is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. This vulnerability arises from missing or incorrect nonce validation in the process_bulk_action() function, allowing an attacker to trick an authenticated user with access to the plugin's dashboard into deleting arbitrary search-term records and associated search history via a forged request.
CVE-2026-17515 is a medium severity information exposure vulnerability in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before version 7.0.4. The flaw arises because one of the plugin's AJAX actions lacks authorization and CSRF protections, allowing any authenticated user, including low-privileged subscribers, to read the import log file and import-related metadata of arbitrary posts. This could lead to unauthorized disclosure of potentially sensitive information stored in these logs and metadata.
CVE-2026-16613 is a Cross-Site Request Forgery (CSRF) vulnerability in the GDPR Cookie Compliance WordPress plugin before version 5.1.0. The flaw allows an attacker to log out any user and delete the site's cookies by tricking them into clicking a crafted link. This occurs because the plugin expires visitor cookies via an unauthenticated action without verifying the request origin. The vulnerability has a medium severity score of 4.3 and does not impact confidentiality or integrity but affects availability by causing user logouts.
CVE-2026-66884 is a Cross-Site Request Forgery (CSRF) vulnerability in the Erlang Ecosystem Foundation's oidcc_plug library, specifically in the Oidcc.Plug.AuthorizationCallback module. The flaw allows an attacker to trick a victim's browser into completing an authorization flow that the victim did not initiate, potentially signing the victim into the attacker's account. This occurs because the callback endpoint processes requests without a valid session by disabling security checks, including nonce, state, PKCE, peer IP, and user agent validations. The vulnerability affects versions from 0.2.0-beta.1 before 0.5.0 of oidcc_plug.
CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/<id> endpoint accepted HTTP GET requests for an operation that modified application state.
An unauthenticated remote attacker could construct a malicious link or embed a request targeting this endpoint and induce an authenticated CTI-Transmute administrator to visit the attacker-controlled content. If the administrator had an active session, the browser would automatically include the administrator’s session credentials, causing the selected user account to be deleted without the administrator intentionally confirming the operation.
Successful exploitation requires interaction from a currently authenticated administrator who has permission to delete users. The attacker does not need a CTI-Transmute account or administrative privileges because the forged request executes using the victim administrator’s session.
The vulnerability could allow an attacker to delete arbitrary user accounts, resulting in unauthorized modification of application state and denial of access for affected users. Depending on whether administrators can delete other administrators or the final administrative account, exploitation could also disrupt administration of the CTI-Transmute instance.
The patch resolves the issue by restricting the deletion endpoint to HTTP POST requests and submitting the deletion through a form containing a CSRF token.
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.
The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth_for_authorize function. This makes it possible for unauthenticated attackers to create new administrator accounts with attacker-supplied credentials via a CSRF-based REST authentication bypass, granted they can trick a site administrator into performing an action such as clicking on a link. This bypass can be combined with WordPress's ?_method=POST method-override support to convert a top-navigation GET request into an authenticated POST to the REST users endpoint, requiring no existing account on the attacker's part.
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the ms_update AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple PHP Jabbers Appointment Scheduler scripts due to missing CSRF tokens or appropriate SameSite cookie attributes. This flaw allows attackers to perform unauthorized actions on behalf of authenticated users, including creating new administrative accounts. The vulnerability has a medium severity score of 6.9 and has been assigned CVE-2025-67651. The issue is known and published but no specific affected versions or patches have been provided in the available data.
Apache Zeppelin versions 0.6.0 through 0.12.0 have a Cross-Site Request Forgery (CSRF) vulnerability due to a permissive default CORS configuration that allows cross-origin state-changing requests and accepts text/plain request bodies. This enables an attacker to trick an authenticated user into performing unintended actions via REST and WebSocket endpoints. The issue is fixed in version 0.12.1.
Apache JSPWiki versions prior to 2.12.4 are vulnerable to a Cross-Site Request Forgery (CSRF) issue related to JSON Hijacking. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is fixed in version 2.12.4.