CVE-2026-66602

Deferred Deferred - Pending Action

Cross-Site Request Forgery in HashBar WordPress Plugin

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: Patchstack

Description

Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-66602

EUVD

EUVD-2026-62209

Affected Vendors & Products

Vendor	Product	Version / Range
hashbar	wordpress_notification_bar	to 2.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in the DevItems HashBar WordPress Notification Bar plugin. It allows attackers to trick users into executing unwanted actions on the website where the plugin is installed, potentially leading to unauthorized changes or data theft.

Detection Guidance

This vulnerability is a CSRF issue in a WordPress plugin. Detection requires checking for the presence of the vulnerable plugin version (HashBar – WordPress Notification Bar up to 2.0.0) and reviewing WordPress logs for unauthorized requests. No direct network commands detect this, but inspecting plugin files and WordPress admin activity can help.

Impact Analysis

An attacker could exploit this to perform actions on your behalf without your consent, such as modifying settings, deleting content, or stealing sensitive information if you are logged into the WordPress admin panel.

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, potentially violating GDPR (data protection) or HIPAA (health data privacy) by exposing or altering sensitive user information without proper authorization.

Mitigation Strategies

Update HashBar – WordPress Notification Bar to the latest version beyond 2.0.0 to address the CSRF vulnerability. Disable the plugin if not in use and monitor for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-66602. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70