CVE-2026-24966
BaseFortify
Publication date: 2026-02-03
Last updated on: 2026-02-03
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24966 is a Cross Site Request Forgery (CSRF) vulnerability affecting the WordPress Copyscape Premium Plugin versions up to and including 1.4.1.
This vulnerability allows a malicious actor to trick privileged users into executing unwanted actions while authenticated, such as by clicking a malicious link, visiting a crafted page, or submitting a form.
The exploit requires user interaction and targets higher privileged users, potentially forcing them to perform unauthorized actions under their current session.
It is classified under OWASP Top 10 category A1: Broken Access Control and has a low severity with a CVSS score of 4.3.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the Cross-Site Request Forgery (CSRF) vulnerability in Copyscape Premium on compliance with common standards and regulations such as GDPR or HIPAA.
However, since the vulnerability allows privileged users to be tricked into performing unauthorized actions, it could potentially lead to unauthorized data access or modification if exploited, which might indirectly affect compliance with data protection regulations.
No explicit details or assessments regarding regulatory compliance impact are given in the available resources.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can impact you by allowing an attacker to trick privileged users into performing unauthorized actions while they are logged in.'}, {'type': 'paragraph', 'content': "Such actions could be triggered by the user clicking a malicious link, visiting a crafted page, or submitting a form, potentially compromising the integrity of the user's session."}, {'type': 'paragraph', 'content': 'However, the threat is considered low severity because it requires user interaction and affects only privileged users.'}, {'type': 'paragraph', 'content': 'Updating the plugin to version 1.4.2 or later mitigates this risk.'}] [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability is a Cross Site Request Forgery (CSRF) issue affecting the WordPress Copyscape Premium Plugin versions up to and including 1.4.1. Detection typically involves verifying the plugin version installed on your WordPress site.'}, {'type': 'paragraph', 'content': 'You can check the installed version of the Copyscape Premium plugin by accessing your WordPress admin dashboard under Plugins, or by using command line tools to inspect the plugin files.'}, {'type': 'paragraph', 'content': 'For example, if you have shell access to your WordPress installation, you can run the following command to find the plugin version:'}, {'type': 'list_item', 'content': "grep -i 'Version' wp-content/plugins/copyscape-premium/copyscape-premium.php"}, {'type': 'paragraph', 'content': 'Additionally, monitoring for suspicious user actions that could indicate CSRF exploitation requires web application firewall (WAF) logs or security plugins that detect unusual requests or unauthorized actions performed by privileged users.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to update the Copyscape Premium plugin to version 1.4.2 or later, where this vulnerability is resolved.
If automatic updates are available, enabling the auto-update feature for this plugin can provide rapid protection.
Additionally, limiting privileged user exposure to untrusted links or pages and educating users about the risks of clicking suspicious links can reduce the risk of exploitation.