EUVD-2026-37974
GHSA-x7qw-qpv3-vwj5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered CSRF with mandatory admin interaction (UI:R, PR:N) and impact limited to plugin configuration integrity (I:L); no confidentiality or availability impact applies.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The User Admin Simplifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the useradminsimplifier_options_page function. This makes it possible for unauthenticated attackers to reset and permanently delete any user's stored menu and admin-bar configuration via a forged request that triggers uas_save_admin_options() and overwrites the useradminsimplifier_options database entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in the User Admin Simplifier WordPress plugin (all versions up to and including 3.0.0) enables unauthenticated remote attackers to permanently delete any user's stored admin menu and admin-bar configuration by tricking a logged-in site administrator into submitting a forged request. The flaw exists because the useradminsimplifier_options_page function performs no valid nonce check before invoking uas_save_admin_options(), which unconditionally overwrites the useradminsimplifier_options database entry. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA's Known Exploited Vulnerabilities catalog.
Technical ContextAI
The affected software is the User Admin Simplifier WordPress plugin authored by adamsilverstein (CPE: cpe:2.3:a:adamsilverstein:user_admin_simplifier:*:*:*:*:*:*:*:*), designed to let administrators customize the WordPress dashboard menu and admin toolbar on a per-user basis. The root cause is CWE-352 (Cross-Site Request Forgery): WordPress core provides nonce tokens as a CSRF defense mechanism, and any state-changing function must verify a nonce before processing input. The vulnerable function useradminsimplifier_options_page - referenced in the plugin's useradminsimplifier.php at lines 161, 204, and 222 - calls uas_save_admin_options() without performing this verification. Because the browser automatically includes session cookies with any cross-origin request an administrator is tricked into making, the server cannot distinguish a legitimate admin action from a forged one, and the useradminsimplifier_options database row is silently overwritten or cleared.
RemediationAI
A patch is available via the WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3566637%40user-admin-simplifier&new=3566637%40user-admin-simplifier&sfp_email=&sfph_mail=), however the specific released version number containing the fix is not confirmed in the available intelligence data - administrators should update User Admin Simplifier to the latest version available in the WordPress plugin dashboard and verify the installed version exceeds 3.0.0. If an immediate update cannot be performed, the safest interim compensating control is to deactivate the User Admin Simplifier plugin entirely, which eliminates the vulnerable endpoint with no permanent data loss (stored configurations can be reconfigured after re-enabling the patched version). As an additional defense-in-depth measure, deploying a Web Application Firewall with WordPress-aware CSRF rules (such as Wordfence's own firewall) can block forged requests targeting this endpoint. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0920fc70-1c4b-45ff-86f6-14640286b5e6 for the latest patch version confirmation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today