What the vulnerability does
01Description
The Page Title, Description & Open Graph Updater plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.02. This is due to missing nonce validation on multiple AJAX actions including dieno_update_page_title. This makes it possible for unauthenticated attackers to update page titles and metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
The Page Title, Description & Open Graph Updater plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions 1.02 and earlier. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions on the plugin's settings without the admin's knowledge or consent. This could allow modification of page metadata or other plugin configurations.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into visiting a malicious page that changes the plugin's settings without their consent.
Potential impact on your site
04Site Impact
An attacker can modify page titles, descriptions, and Open Graph metadata through a CSRF attack targeting your administrators.
Conditions required to exploit
05Prerequisites
Admin must be logged in and visit an attacker-controlled webpage; no special privileges or direct site access required.
Key dates
06Disclosure timeline
February 19, 2026
CVE published
April 8, 2026
Record updated
