CVE-2026-6702
Deferred Deferred - Pending Action

Cross-Site Request Forgery in Publish 2 Ping.fm WordPress Plugin

Publication date: 2026-05-05

Last updated on: 2026-05-05

Assigner: Wordfence

Description
The Publish 2 Ping.fm plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the '/wp-admin/options-general.php?page=admin.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-05-05
Last Modified
2026-05-05
Generated
2026-07-06
AI Q&A
2026-05-05
EPSS Evaluated
2026-07-05
NVD
CVE-2026-6702
EUVD
EUVD-2026-27207

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
publish_2_ping.fm plugin to 1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in the Publish 2 Ping.fm plugin for WordPress, affecting all versions up to and including 1.1. It is a Cross-Site Request Forgery (CSRF) issue caused by missing or incorrect nonce validation on a specific admin settings page. This flaw allows unauthenticated attackers to trick a site administrator into performing unintended actions, such as updating plugin settings or injecting malicious scripts, by sending forged requests.

Impact Analysis

This vulnerability can allow attackers to modify plugin settings or inject malicious web scripts without proper authorization. If an administrator is tricked into clicking a malicious link, the attacker can execute actions that compromise the integrity and security of the WordPress site. This can lead to unauthorized changes, potential site defacement, or further exploitation through injected scripts.

Mitigation Strategies

To mitigate this vulnerability, you should update or remove the Publish 2 Ping.fm plugin if it is installed on your WordPress site, especially if it is version 1.1 or earlier.

Additionally, ensure that nonce validation is properly implemented on the '/wp-admin/options-general.php?page=admin.php' page to prevent unauthorized requests.

As a precaution, educate site administrators to avoid clicking on suspicious links that could trigger forged requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart