CVE-2026-4141
Cross-Site Request Forgery in Quran Translations WordPress Plugin
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | quran_translations | to 1.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Quran Translations plugin for WordPress is vulnerable to a Cross-Site Request Forgery (CSRF) attack in all versions up to and including 1.7.
This vulnerability exists because the function quran_playlist_options(), which handles the plugin's settings page, does not perform nonce validation.
Specifically, the function processes POST requests to update plugin options using update_option() without including a wp_nonce_field() in the form or verifying the nonce with wp_verify_nonce() or check_admin_referer() before processing.
As a result, an unauthenticated attacker can trick a site administrator into performing an action, such as clicking a malicious link, which causes the administrator's browser to send a forged request that modifies the plugin settings.
How can this vulnerability impact me? :
This vulnerability allows an attacker to modify the plugin settings without authentication by tricking an administrator into clicking a malicious link.
- The attacker can toggle display options for PDF, RSS, podcast, media player links, playlist title, and playlist code.
While the vulnerability does not allow direct data theft or site takeover, it can lead to unauthorized changes in how content is displayed or accessed, potentially disrupting site functionality or user experience.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the Quran Translations plugin for WordPress to a version later than 1.7 where nonce validation is properly implemented.
If an update is not immediately available, restrict access to the plugin's settings page to trusted administrators only and avoid clicking on suspicious links that could trigger forged requests.
Additionally, consider implementing manual nonce validation in the plugin's quran_playlist_options() function by adding wp_nonce_field() in the form and verifying it with wp_verify_nonce() or check_admin_referer() before processing POST requests.