What the vulnerability does
01Description
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to inverted nonce verification logic in the amp_theme_ajaxcomments AJAX handler, which rejects requests with VALID nonces and accepts requests with MISSING or INVALID nonces. This makes it possible for unauthenticated attackers to submit comments on behalf of logged-in users via a forged request granted they can trick a user into performing an action such as clicking on a link, and the plugin's template mode is enabled.
Explanation of Vulnerability in Simple Terms
02Summary
AMP for WP versions up to 1.1.9 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unwanted actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, triggers unintended changes to plugin settings or site configuration. The vulnerability requires no special privileges but does require the admin to click a link or visit a page controlled by the attacker.
What an attacker can do
03Attacker Capabilities
Trick an admin into performing unwanted actions on the site, such as changing plugin settings or configuration.
Potential impact on your site
04Site Impact
An attacker can modify AMP for WP settings or site configuration if an admin is tricked into visiting a malicious page.
Conditions required to exploit
05Prerequisites
Admin must visit a malicious link or page crafted by the attacker; no special authentication or privileges needed.
Key dates
06Disclosure timeline
January 7, 2026
CVE published
April 8, 2026
Record updated
