CVE-2026-6702
Cross-Site Request Forgery in Publish 2 Ping.fm WordPress Plugin
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| publish_2_ping.fm | plugin | to 1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Publish 2 Ping.fm plugin for WordPress, affecting all versions up to and including 1.1. It is a Cross-Site Request Forgery (CSRF) issue caused by missing or incorrect nonce validation on a specific admin settings page. This flaw allows unauthenticated attackers to trick a site administrator into performing unintended actions, such as updating plugin settings or injecting malicious scripts, by sending forged requests.
How can this vulnerability impact me? :
This vulnerability can allow attackers to modify plugin settings or inject malicious web scripts without proper authorization. If an administrator is tricked into clicking a malicious link, the attacker can execute actions that compromise the integrity and security of the WordPress site. This can lead to unauthorized changes, potential site defacement, or further exploitation through injected scripts.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update or remove the Publish 2 Ping.fm plugin if it is installed on your WordPress site, especially if it is version 1.1 or earlier.
Additionally, ensure that nonce validation is properly implemented on the '/wp-admin/options-general.php?page=admin.php' page to prevent unauthorized requests.
As a precaution, educate site administrators to avoid clicking on suspicious links that could trigger forged requests.