What the vulnerability does
01Description
The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation in the quran_playlist_options() function that handles the plugin's settings page. The function processes POST requests to update plugin options via update_option() without any wp_nonce_field() in the form or wp_verify_nonce()/check_admin_referer() verification before processing. This makes it possible for unauthenticated attackers to modify plugin settings (toggling display options for PDF, RSS, podcast, media player links, playlist title, and playlist code) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Quran Translations versions 1.7 and earlier contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in user, performs unwanted actions on their behalf. The vulnerability requires user interaction—the victim must visit the attacker's page while authenticated to the site.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions on behalf of a logged-in user without their knowledge.
Potential impact on your site
04Site Impact
Users' accounts can be manipulated to perform unintended actions if they visit malicious sites while logged in.
Conditions required to exploit
05Prerequisites
Victim must be logged in and visit an attacker-controlled webpage.
Key dates
06Disclosure timeline
April 8, 2026
CVE published
April 8, 2026
Record updated
