CVE-2026-7047
Cross-Site Request Forgery in Frontend User Notes WordPress Plugin
Publication date: 2026-06-06
Last updated on: 2026-06-06
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frontend_user_notes | frontend_user_notes | to 2.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists in all versions of the Frontend User Notes plugin up to and including 2.1.1 due to missing or incorrect nonce validation. To mitigate this vulnerability, you should update the Frontend User Notes plugin to a version later than 2.1.1 where the issue is fixed.
Additionally, as a precaution, limit the ability of users to click on untrusted links while logged in as administrators, since the attack requires tricking an authenticated user into visiting a malicious page.
Can you explain this vulnerability to me?
The Frontend User Notes plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 2.1.1. This occurs because the plugin's funp_ajax_modify_notes function lacks proper nonce validation. As a result, an unauthenticated attacker can trick a logged-in user, such as a site administrator, into visiting a malicious page that sends a forged request to modify that user's own note content without their consent.
The attack is limited to modifying only the notes owned by the victim user because the plugin enforces ownership by comparing the note's stored user ID with the current session's user ID. Therefore, attackers cannot alter notes belonging to other users.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to cause unauthorized changes to a logged-in user's notes by tricking them into performing an action such as clicking a malicious link. Although the attacker cannot modify notes of other users, they can overwrite the victim's own note content without their knowledge or consent.
This could lead to loss or corruption of important note data for the affected user, potentially disrupting workflows or causing confusion.