CVE-2026-9599
Cross-Site Request Forgery in Tectite Forms WordPress Plugin
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tectite | forms | to 1.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists in all versions of the Tectite Forms plugin up to and including 1.3 due to missing or incorrect nonce validation on the admin_init function.
To mitigate this vulnerability, you should update the Tectite Forms plugin to a version later than 1.3 where the nonce validation issue is fixed.
Additionally, as a temporary measure, restrict access to the WordPress admin area to trusted users only and educate administrators to avoid clicking on suspicious links that could trigger forged requests.
Can you explain this vulnerability to me?
The Tectite Forms plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) in all versions up to and including 1.3. This occurs because the plugin's admin_init function lacks proper nonce validation, which is a security measure to verify legitimate requests.
As a result, an attacker who is not authenticated can trick a site administrator into performing an action, such as clicking a malicious link, which then allows the attacker to modify the plugin's settings without authorization.
How can this vulnerability impact me? :
This vulnerability can allow an unauthenticated attacker to change the settings of the Tectite Forms plugin on your WordPress site by tricking an administrator into clicking a malicious link.
Such unauthorized changes could affect the behavior of the plugin, potentially leading to security risks or disruptions in site functionality.