CVE-2026-4133
CSRF Vulnerability in TextP2P Plugin Allows Settings Manipulation
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imtextp2p | widget | to 1.7 (inc) |
| textp2p | texting_widget | to 1.7 (inc) |
| wordfence | textp2p_texting_widget | to 1.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The TextP2P Texting Widget plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.7. This occurs because the plugin's settings update function, imTextP2POptionPage(), lacks proper nonce validation. Specifically, the form does not include a wp_nonce_field(), and the POST handler does not verify the nonce before processing changes.
As a result, an attacker can trick a site administrator into performing an action, such as clicking a malicious link, which then allows the attacker to update all plugin settings without authentication.
How can this vulnerability impact me? :
This vulnerability allows an unauthenticated attacker to modify all settings of the TextP2P plugin by tricking an administrator into executing a forged request. The attacker can change chat widget titles, messages, API credentials, colors, and reCAPTCHA configuration.
Such unauthorized changes could lead to manipulation of the chat widget's behavior, potential exposure of sensitive API credentials, and weakening of security measures like reCAPTCHA, which may increase the risk of further attacks or misuse.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this Cross-Site Request Forgery vulnerability in the TextP2P Texting Widget plugin for WordPress, you should update the plugin to a version later than 1.7 where nonce validation is properly implemented.
If an update is not immediately available, you can manually add nonce validation by ensuring that the form includes a wp_nonce_field() and that the POST handler calls check_admin_referer() or wp_verify_nonce() before processing any settings changes.
Additionally, educate site administrators to avoid clicking on suspicious links that could trigger forged requests.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a missing nonce validation in the TextP2P Texting Widget plugin for WordPress, allowing Cross-Site Request Forgery (CSRF) attacks. Detection typically involves checking whether the vulnerable plugin version (up to and including 1.7) is installed and whether the plugin's settings update requests lack proper nonce validation.
To detect this on your system, you can verify the plugin version installed on your WordPress site and inspect the plugin files for the presence or absence of nonce fields and verification calls in the relevant functions.
- Check the installed plugin version via WP-CLI: `wp plugin list | grep textp2p`
- Search plugin files for nonce usage: `grep -r "wp_nonce_field" wp-content/plugins/textp2p-texting-widget/`
- Check for nonce verification calls in the POST handler: `grep -r "check_admin_referer" wp-content/plugins/textp2p-texting-widget/` or `grep -r "wp_verify_nonce" wp-content/plugins/textp2p-texting-widget/`
Network detection of exploit attempts could involve monitoring for suspicious POST requests to the plugin's settings update endpoint that do not include valid nonce tokens, but specific commands for this are not provided in the available information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to update all plugin settings, including sensitive information such as API credentials and reCAPTCHA configuration, by exploiting a Cross-Site Request Forgery (CSRF) flaw. This unauthorized modification of settings could potentially lead to security weaknesses or data exposure.
However, there is no specific information provided about the direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.