CVE-2026-100524 MEDIUM

CVE-2026-100524: Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Vendor Cotonti
Product Cotonti
Weakness CWE-352 · CSRF
Published September 26, 2026
Last update September 26, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause extensions by tricking them into visiting a malicious page while authenticated.

Key dates

02Disclosure timeline

September 26, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-24537 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-13243 Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063 CVE-2026-57761 WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability CVE-2026-7444 Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery