CVE-2026-7615
Cross-Site Request Forgery in Widget Context WordPress Plugin
Publication date: 2026-05-22
Last updated on: 2026-05-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kasparsd | widget_context | to 1.3.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Widget Context plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) in all versions up to and including 1.3.3.
This vulnerability exists because the plugin does not properly validate nonces in the save_widget_context_settings function.
As a result, an attacker who is not authenticated can trick a site administrator into performing an action, such as clicking a malicious link, which causes the administrator's browser to send a forged POST request to /wp-admin/widgets.php.
This forged request can modify widget visibility context settings stored in the WordPress options table without the administrator's explicit consent.
How can this vulnerability impact me? :
This vulnerability allows an unauthenticated attacker to modify widget visibility settings on a WordPress site by tricking an administrator into performing an action.
Such unauthorized changes could affect the appearance or behavior of widgets on the site, potentially leading to misinformation, user confusion, or exposure of sensitive information if widgets display such data.
While the vulnerability does not directly compromise data confidentiality or availability, it does allow integrity of widget settings to be compromised.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the Widget Context plugin for WordPress to a version later than 1.3.3 where nonce validation on the save_widget_context_settings function is properly implemented.
Additionally, ensure that site administrators are cautious about clicking on untrusted links that could trigger forged POST requests to /wp-admin/widgets.php.