What the vulnerability does
01Description
The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to a missing nonce verification in the taqnix_delete_my_account() function, where the check_ajax_referer() call is explicitly commented out on line 883. This makes it possible for unauthenticated attackers to trick a logged-in non-administrator user into deleting their own account via a forged request granted they can trick the user into performing an action such as clicking a link or visiting a malicious page.
Explanation of Vulnerability in Simple Terms
02Summary
Taqnix versions 1.0.3 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in user, performs unwanted actions on their behalf without their knowledge. The vulnerability requires user interaction—the victim must visit the attacker's page while authenticated. Integrity of data or settings may be compromised.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions on a user's account by tricking them into visiting a malicious webpage.
Potential impact on your site
04Site Impact
Users' accounts can be manipulated to perform unintended actions if they visit untrusted sites while logged in.
Conditions required to exploit
05Prerequisites
User must be logged in and visit an attacker-controlled webpage; no special privileges required.
Key dates
06Disclosure timeline
April 24, 2026
CVE published
April 24, 2026
Record updated
