CVE-2026-7047
Received Received - Intake
Cross-Site Request Forgery in Frontend User Notes WordPress Plugin

Publication date: 2026-06-06

Last updated on: 2026-06-06

Assigner: Wordfence

Description
The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the funp_ajax_modify_notes function. This makes it possible for unauthenticated attackers to trick a logged-in user into visiting a malicious page, causing unauthorized overwriting of that victim's own note content via a forged cross-site request to wp_update_post() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to ownership enforcement comparing the note's stored _funp_single_user_id meta against the current session's user ID, the attack is limited to modifying only notes belonging to the tricked victim, and cannot be used to alter notes owned by arbitrary third-party users.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-06
Last Modified
2026-06-06
Generated
2026-06-06
AI Q&A
2026-06-06
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
frontend_user_notes frontend_user_notes to 2.1.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?

The vulnerability exists in all versions of the Frontend User Notes plugin up to and including 2.1.1 due to missing or incorrect nonce validation. To mitigate this vulnerability, you should update the Frontend User Notes plugin to a version later than 2.1.1 where the issue is fixed.

Additionally, as a precaution, limit the ability of users to click on untrusted links while logged in as administrators, since the attack requires tricking an authenticated user into visiting a malicious page.


Can you explain this vulnerability to me?

The Frontend User Notes plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 2.1.1. This occurs because the plugin's funp_ajax_modify_notes function lacks proper nonce validation. As a result, an unauthenticated attacker can trick a logged-in user, such as a site administrator, into visiting a malicious page that sends a forged request to modify that user's own note content without their consent.

The attack is limited to modifying only the notes owned by the victim user because the plugin enforces ownership by comparing the note's stored user ID with the current session's user ID. Therefore, attackers cannot alter notes belonging to other users.


How can this vulnerability impact me? :

This vulnerability can allow an attacker to cause unauthorized changes to a logged-in user's notes by tricking them into performing an action such as clicking a malicious link. Although the attacker cannot modify notes of other users, they can overwrite the victim's own note content without their knowledge or consent.

This could lead to loss or corruption of important note data for the affected user, potentially disrupting workflows or causing confusion.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart