What the vulnerability does
01Description
The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
Explanation of Vulnerability in Simple Terms
02Summary
WP Editor versions up to 1.2.9.2 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, executes unwanted changes without their knowledge. This affects confidentiality, integrity, and availability of the site.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions on the site by tricking an admin into visiting a malicious link.
Potential impact on your site
04Site Impact
Admins could unknowingly make changes to site content, settings, or user accounts when visiting untrusted links.
Conditions required to exploit
05Prerequisites
Admin must visit a malicious link or page crafted by the attacker; no special privileges or authentication required from attacker.
Key dates
06Disclosure timeline
May 1, 2026
CVE published
May 1, 2026
Record updated
