What is the CVSS score of CVE-2026-1924?

CVE-2026-1924 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-1924

EUVD-2026-21250 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-10 Wordfence

WordPress CSRF Aruba

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21250

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

CVE Published

Apr 10, 2026 - 01:24 nvd

MEDIUM 4.3

DescriptionCVE.org

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing nonce verification on the ahsc_ajax_reset_options() function. This makes it possible for unauthenticated attackers to reset all plugin settings to their default values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-site request forgery in Aruba HiSpeed Cache WordPress plugin up to version 3.0.4 allows unauthenticated attackers to reset all plugin settings to defaults by tricking site administrators into clicking a malicious link, due to missing nonce verification on the ahsc_ajax_reset_options() function. The CVSS score of 4.3 reflects the low-impact integrity violation requiring user interaction, with no known public exploit code or confirmed active exploitation.

Technical ContextAI

The vulnerability exists in the ahsc_ajax_reset_options() AJAX function within the Aruba HiSpeed Cache plugin (CPE: cpe:2.3:a:arubadev:aruba_hispeed_cache:*:*:*:*:*:*:*:*), a WordPress caching optimization plugin. The root cause is classified as CWE-352 (Cross-Site Request Forgery), stemming from the absence of cryptographic nonce validation on an administrative AJAX endpoint. WordPress nonces are single-use tokens that prevent CSRF attacks by validating that requests originate from the site itself. When an AJAX function lacks nonce verification, attackers can craft malicious web pages or emails containing hidden requests that execute in the context of an authenticated administrator's browser session, bypassing the security assumption that AJAX calls come from trusted sources.

RemediationAI

Update the Aruba HiSpeed Cache plugin to version 3.0.5 or later, which includes nonce verification on the ahsc_ajax_reset_options() function. Site administrators should access the WordPress admin dashboard, navigate to Plugins, and update the plugin immediately. The patch can be verified by checking the plugin repository changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Faruba-hispeed-cache/tags/3.0.4&new_path=%2Faruba-hispeed-cache/tags/3.0.5) which documents the fix. As a temporary mitigation while awaiting update deployment, administrators may restrict access to the WordPress admin panel via IP allowlisting or Web Application Firewall rules to reduce the likelihood of successful CSRF exploitation, though this does not eliminate the vulnerability.