CVE-2026-53736

Deferred Deferred - Pending Action

Cross-Site Request Forgery in Easy Twitter Feeds Plugin

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: VulnCheck

Description

Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless of post type.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-10

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-53736

EUVD

EUVD-2026-36137

Affected Vendors & Products

Vendor	Product	Version / Range
easy_twitter_feeds	easy_twitter_feeds	to 1.2.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Easy Twitter Feeds versions before 1.2.13. It is a cross-site request forgery (CSRF) issue in the duplicate_post action handler, which does not verify a nonce. This means an attacker can trick an authenticated user into clicking a specially crafted link that causes the duplication of any post, regardless of its type.

Impact Analysis

The vulnerability allows attackers to perform unauthorized actions on behalf of authenticated users by duplicating posts without their consent. This could lead to unwanted content duplication, potential confusion, or misuse of the platform's posting capabilities.

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-53736 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

The vulnerability in Easy Twitter Feeds before version 1.2.13 is a Cross-Site Request Forgery (CSRF) issue in the duplicate_post action handler due to missing nonce verification.

To detect this vulnerability on your system, you can check the version of the Easy Twitter Feeds plugin installed. If it is any version before 1.2.13, it is vulnerable.

There are no specific network or system commands provided in the resources to detect exploitation attempts or the vulnerability itself.

Mitigation Strategies

The primary mitigation step is to update the Easy Twitter Feeds plugin to version 1.2.13 or later, where the nonce verification issue in the duplicate_post action handler has been fixed.

Until the update can be applied, restrict access to the duplicate_post action handler or implement additional nonce verification or CSRF protections if possible.

Hi! I’m here to help you understand CVE-2026-53736. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70