CVE-2026-8906
Cross-Site Request Forgery in WP Promoter WordPress Plugin
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_promoter | wp_promoter | to 1.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WP Promoter plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) in all versions up to and including 1.3. This occurs because the plugin is missing or has incorrect nonce validation on a function. As a result, an attacker who is not authenticated can trick a site administrator into performing an action, such as clicking a malicious link, which allows the attacker to update settings and inject malicious web scripts.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to change the settings of the WP Promoter plugin without authorization and inject malicious scripts into the website. This can lead to compromised site integrity, potential defacement, or the execution of malicious code that could affect site visitors or administrators.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability affects all versions of the WP Promoter plugin up to and including 1.3 due to missing or incorrect nonce validation. Immediate mitigation steps include updating the WP Promoter plugin to a version later than 1.3 where the issue is fixed.
Additionally, as this is a Cross-Site Request Forgery vulnerability that requires tricking a site administrator, ensure that administrators avoid clicking on suspicious links and consider implementing additional security measures such as web application firewalls or stricter user interaction policies.