CVE-2026-9722
Cross-Site Request Forgery in Laiser Tag WordPress Plugin
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| laiser_tag | plugin | to 1.2.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Laiser Tag plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) in all versions up to and including 1.2.5. This occurs because the plugin does not properly validate nonces in the addOptionsPageFields function. As a result, an attacker can trick a site administrator into performing an action, such as clicking a malicious link, which allows the attacker to update the plugin's settings without authentication.
How can this vulnerability impact me? :
This vulnerability allows an unauthenticated attacker to change important settings of the Laiser Tag plugin by tricking an administrator into executing a forged request. The attacker can modify settings such as the API key, tag blacklist, relevance threshold, batch size, and tagging toggles. This could lead to unauthorized changes in how the plugin operates, potentially affecting site functionality or security.