What the vulnerability does
01Description
The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8.1. This is due to missing or incorrect nonce validation on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions. This makes it possible for unauthenticated attackers to create, modify and delete taxonomy terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Furthermore, the functions wpbe_save_options, wpbe_bulk_delete_posts_count, wpbe_bulk_delete_posts, and wpbe_save_meta are vulnerable to Cross-Site Request Forgery allowing for plugin options update, post count deletion, post deletion and modification of post metadata via forged request.
Explanation of Vulnerability in Simple Terms
02Summary
The WOLF WordPress plugin versions 1.0.8.1 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. This could allow modification or deletion of posts and settings. The vulnerability requires user interaction—the admin must visit the attacker's page while logged into WordPress.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into modifying or deleting posts and site settings via a malicious webpage.
Potential impact on your site
04Site Impact
Administrators could unknowingly modify or delete posts and settings if they visit a malicious link while logged in.
Conditions required to exploit
05Prerequisites
Admin must visit attacker-controlled webpage while logged into WordPress; no special privileges or authentication required from attacker.
Key dates
06Disclosure timeline
February 5, 2024
CVE published
April 8, 2026
Record updated
