Tailored Tools CVE-2026-111401

Exploitation requires an authenticated WordPress user (in practice a privileged user such as an administrator whose action is worth forging) to be logged in and then tricked into visiting attacker-controlled content or clicking a crafted link while that session is active (UI:R). The root cause is missing or improper CSRF nonce validation on a state-changing action in Tailored Tools versions up to and including 3.0.3. Limiting factors: the attack fails if the victim is not currently authenticated, if the victim never interacts with the malicious content, or if the site runs a patched version; it cannot be executed purely server-to-server without victim participation.

This is a moderate-severity CSRF flaw (CVSS 6.5) in the Tailored Tools WordPress plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates a network-reachable, low-complexity issue requiring no attacker authentication but mandatory user interaction (UI:R), with high integrity impact only (C:N/A:N). The lack of confidentiality or availability impact and the hard dependency on tricking a logged-in victim meaningfully constrain real-world risk. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or automated exploitation - this reads as a defense-in-depth fix rather than an urgent priority. Note PR:N here reflects that the attacker needs no credentials of their own (CSRF abuses the victim's existing authenticated session), which is the standard Patchstack convention and is not contradicted by the description.

An attacker crafts a malicious web page or email containing a forged request targeting a Tailored Tools plugin action, then lures an authenticated WordPress user (typically an administrator) into visiting it. Because the plugin does not validate anti-CSRF nonces, the victim's browser silently submits the state-changing request under their session, altering plugin or site configuration. No public exploit code was identified at time of analysis.