CVE-2026-4002
CSRF in Petje.af Plugin Allows OAuth2 Token and Account Deletion
Publication date: 2026-04-15
Last updated on: 2026-04-15
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| petjeaf | petje_af_plugin | to 2.1.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to force authenticated users to delete their Petje.af member user accounts via forged requests. This could lead to unauthorized account deletions and potential loss of user data integrity.
However, there is no specific information provided about how this vulnerability directly impacts compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
The Petje.af plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 2.1.8. This occurs because the ajax_revoke_token() function, which handles the 'petjeaf_disconnect' AJAX action, does not validate a security nonce to confirm the request's legitimacy.
As a result, attackers can trick authenticated users into performing destructive actions such as revoking OAuth2 tokens, deleting user metadata, and deleting WordPress user accounts with the 'petjeaf_member' role by making them click on a malicious link or visit a malicious website.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized deletion of user accounts and associated data for users with the 'petjeaf_member' role. An attacker can exploit this by forcing authenticated users to unknowingly revoke OAuth2 tokens, delete user metadata, and remove their WordPress user accounts.
The impact includes loss of user access, potential disruption of services relying on these accounts, and possible data loss related to user metadata.