What the vulnerability does
01Description
The Google PageRank Display plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4. This is due to missing nonce validation in the gpdisplay_option() function, which handles the plugin settings page. The settings form does not include a wp_nonce_field(), and the form handler does not call check_admin_referer() or wp_verify_nonce() before processing the POST request. This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a crafted request that changes the plugin's settings (stored via update_option()), such as the display style used to render the PageRank badge.
Explanation of Vulnerability in Simple Terms
02Summary
Google PageRank Display versions 1.4 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a site administrator, performs unwanted actions on the site without the administrator's knowledge. The vulnerability requires the administrator to visit the attacker's page while logged into their site.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions on the site by tricking an administrator into visiting a malicious webpage.
Potential impact on your site
04Site Impact
An attacker can modify site settings or data if they trick an admin into clicking a malicious link.
Conditions required to exploit
05Prerequisites
Site administrator must visit an attacker-controlled webpage while logged into the site.
Key dates
06Disclosure timeline
April 22, 2026
CVE published
April 22, 2026
Record updated
