CVE-2026-6452
Cross-Site Request Forgery in Bigfishgames Syndicate WordPress Plugin
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bigfishgames | syndicate | to 1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Bigfishgames Syndicate plugin for WordPress has a vulnerability called Cross-Site Request Forgery (CSRF) in all versions up to and including 1.2. This happens because the plugin's function bigfishgames_syndicate_submenu() does not properly validate nonces, which are security tokens meant to prevent unauthorized actions.
As a result, an attacker who is not authenticated can trick a site administrator into performing an action, such as clicking a malicious link, which then allows the attacker to reset and update the plugin settings without permission.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to change the settings of the Bigfishgames Syndicate plugin on your WordPress site without your consent.
Since the attacker can reset and update plugin settings through a forged request, this could lead to unauthorized configuration changes that might affect the functionality or security of your website.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the Cross-Site Request Forgery vulnerability in the Bigfishgames Syndicate plugin for WordPress, you should update the plugin to a version later than 1.2 where the nonce validation issue is fixed.
If an update is not immediately available, restrict access to the plugin settings page to trusted administrators only and avoid clicking on suspicious links that could trigger forged requests.