What the vulnerability does
01Description
The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to perform various unauthorized actions including creating, editing, and deleting resources and categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Resource Library for Logged In Users versions 1.5 and earlier contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in user, performs unwanted actions on their behalf. The vulnerability requires user interaction and does not expose sensitive data, but can modify site content or settings.
What an attacker can do
03Attacker Capabilities
Trick a logged-in user into performing unwanted actions, such as modifying content or changing settings.
Potential impact on your site
04Site Impact
Users' accounts can be used to make unauthorized changes to the site without their knowledge or consent.
Conditions required to exploit
05Prerequisites
A logged-in user must visit an attacker-controlled page or click a malicious link while authenticated.
Key dates
06Disclosure timeline
December 12, 2025
CVE published
April 8, 2026
Record updated
