CVE-2026-28172
Received Received - Intake

Unauthenticated CSRF in Tracking Code Manager

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Patchstack

Description
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-28172
EUVD
EUVD-2026-53948

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
patchstack tracking_code_manager to 2.6.0 (inc)
patchstack tracking_code_manager 2.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability affecting Tracking Code Manager plugin versions 2.6.0 and below. It allows attackers to trick privileged users into executing unwanted actions through malicious links or forms while authenticated. The flaw stems from improper access control in the plugin.

Detection Guidance

To detect this vulnerability, check if the Tracking Code Manager plugin version is 2.6.0 or below. You can use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly. Look for the presence of the vulnerable versions.

Impact Analysis

An attacker could exploit this to perform actions on behalf of authenticated users, potentially modifying tracking codes or other plugin settings. Successful exploitation requires a privileged user to interact with a malicious link or form, which could lead to unauthorized changes in the WordPress site.

Mitigation Strategies

Immediately update the Tracking Code Manager plugin to version 2.7.0 or later. Enable auto-update for vulnerable plugins if using Patchstack. Remove any unnecessary privileged user interactions with untrusted content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28172. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart