What the vulnerability does
01Description
The BirdSeed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing nonce validation in the birdseed_plugin_settings_page() function. The function processes the 'birdseed_token' GET parameter and saves it to the database via update_option() without verifying a nonce. This makes it possible for unauthenticated attackers to change the plugin's BirdSeed token setting via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
Explanation of Vulnerability in Simple Terms
02Summary
BirdSeed versions 2.2.0 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in BirdSeed user, performs unwanted actions on their behalf without their knowledge. The vulnerability requires user interaction—the victim must visit the attacker's page while authenticated to BirdSeed.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions on a user's BirdSeed account by tricking them into visiting a malicious webpage.
Potential impact on your site
04Site Impact
Users' BirdSeed accounts can be manipulated without their consent if they visit untrusted sites while logged in.
Conditions required to exploit
05Prerequisites
User must be logged into BirdSeed and visit an attacker-controlled webpage.
Key dates
06Disclosure timeline
June 2, 2026
CVE published
June 2, 2026
Record updated
