CVE-2026-25422
CSRF Vulnerability in Popularis Extra Plugin Allows Unauthorized Actions
Publication date: 2026-02-19
Last updated on: 2026-02-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themes4wp | popularis_extra | to 1.2.10 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25422 is a Cross Site Request Forgery (CSRF) vulnerability affecting the WordPress Popularis Extra Plugin versions up to and including 1.2.10.
This vulnerability allows an attacker to trick higher privileged users into executing unwanted actions while authenticated, by means such as clicking a malicious link, visiting a crafted page, or submitting a form.
It requires user interaction and does not affect unauthenticated users directly.
It is classified under OWASP Top 10 A1: Broken Access Control.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to perform unwanted actions on your WordPress site if a privileged user is tricked into interacting with malicious content.
Since it requires privileged user interaction, the attacker could potentially change settings or perform actions that the user is authorized to do.
However, the severity is considered low with a CVSS score of 5.4, and exploitation is unlikely due to the need for user interaction.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability is a Cross Site Request Forgery (CSRF) issue affecting the WordPress Popularis Extra Plugin versions up to and including 1.2.10. Detection involves identifying if the vulnerable plugin version is installed and active on your WordPress site.'}, {'type': 'paragraph', 'content': 'Since this is a plugin vulnerability, you can check the installed plugin version via WordPress admin dashboard or by running commands on the server hosting WordPress.'}, {'type': 'list_item', 'content': 'Use WP-CLI to check the plugin version: wp plugin list --status=active'}, {'type': 'list_item', 'content': "Look for 'popularis-extra' plugin and verify if its version is less than or equal to 1.2.10."}, {'type': 'list_item', 'content': 'Check web server logs for suspicious requests that could indicate CSRF attempts, such as unexpected POST requests to plugin-related endpoints.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for this vulnerability, immediate mitigation steps focus on reducing risk exposure.
- Limit the number of users with high privileges who can be targeted by CSRF attacks.
- Educate privileged users to avoid clicking on suspicious links or visiting untrusted websites while authenticated to the WordPress site.
- Implement additional security measures such as web application firewalls (WAF) that can help detect and block CSRF attack patterns.
- Consider temporarily disabling or deactivating the Popularis Extra plugin until a patch is released.