What is the CVSS score of CVE-2026-1852?

CVE-2026-1852 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-1852

EUVD-2026-22911 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-15 Wordfence

GHSA-4hp8-jw86-79p7

WordPress CSRF

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 11:56 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 11:45 euvd

EUVD-2026-22911

Analysis Generated

Apr 15, 2026 - 11:45 vuln.today

CVE Published

Apr 15, 2026 - 11:30 nvd

MEDIUM 6.1

DescriptionCVE.org

The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the updateLabel() and remove() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages or delete pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery (CSRF) in Product Pricing Table by WooBeWoo plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts or delete pricing tables by tricking site administrators into clicking a malicious link, exploiting missing nonce validation in the updateLabel() and remove() functions across all versions up to and including 1.1.0. No public exploit code identified at time of analysis, but the vulnerability requires only user interaction (UI:R) and has a network attack vector, making it moderately exploitable in real-world scenarios.

Technical ContextAI

The Product Pricing Table by WooBeWoo plugin implements administrative AJAX functions (updateLabel and remove) without proper CSRF token (nonce) validation. In WordPress, nonces are cryptographic tokens that prevent unauthorized actions by verifying that requests originate from legitimate administrative sessions. The CWE-352 root cause indicates the plugin fails to implement or properly validate these tokens before processing state-changing operations. The vulnerability affects the WordPress plugin ecosystem, where CSRF flaws against authenticated administrators can lead to unauthorized modifications of site content or database structures. The CPE indicates all versions up to 1.1.0 of the woobeewoo:product_pricing_table_by_woobewoo product are affected.

RemediationAI

Update the Product Pricing Table by WooBeWoo plugin to version 1.1.1 or later, which implements proper nonce validation on the updateLabel() and remove() functions. Site administrators should check the Wordfence vulnerability page (https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b459e0-4bd9-443e-96e4-91663a35c26e) for confirmation of the fix status and deployment instructions. In the interim before applying the patch, limit administrative access to trusted personnel only and monitor audit logs for suspicious admin activity. Additionally, use WordPress security plugins to implement CSRF protection layers and educate administrators about not clicking suspicious links from untrusted sources.