What is the CVSS score of CVE-2026-2723?

CVE-2026-2723 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2723?

Organizations using for WordPress is vulnerable to Cross-Site Request Forgery in all should be aware of moderate risk from CVE-2026-2723, a cross-site request forgery vulnerability rated CVSS 6.1.

How to fix or mitigate CVE-2026-2723?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Cross-Site Request Forgery in and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

WordPress CVE-2026-2723

EUVD-2026-14152 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-21 Wordfence

GHSA-x8rg-w4fm-9p2g

WordPress CSRF

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14152

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.1

DescriptionCVE.org

The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page handlers for saving, adding, and deleting snippets. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

The Post Snippits WordPress plugin for all versions up to and including 1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation on settings page handlers that manage snippet creation, modification, and deletion. Unauthenticated attackers can exploit this by crafting malicious requests that, when clicked by an administrator, allow injection of arbitrary scripts and modification of plugin settings, potentially leading to site compromise. The vulnerability has a CVSS score of 6.1 with a network attack vector requiring user interaction.

Technical ContextAI

The vulnerability stems from insufficient CSRF protection in the Post Snippits plugin (CPE: cpe:2.3:a:phy9pas:post_snippits:*:*:*:*:*:*:*:*), which is classified as CWE-352 (Cross-Site Request Forgery). The plugin processes administrative actions—specifically saving, adding, and deleting code snippets—through WordPress settings page handlers without implementing WordPress nonce verification mechanisms. WordPress nonces are cryptographic tokens that validate requests originated from legitimate admin sessions. Source code analysis from the official WordPress plugin repository (lines 55, 71, and 77 in post-snippits.php) shows the vulnerable handlers lack proper wp_verify_nonce() or check_admin_referer() calls, allowing attackers to forge requests that execute plugin functionality with the privileges of a logged-in administrator. The attack surface is the WordPress admin interface where plugin settings are managed.

RemediationAI

Site administrators should immediately deactivate and remove the Post Snippits plugin from their WordPress installations until a patched version is released. The primary remediation is to upgrade to a patched version once available from the plugin developer (monitor https://plugins.trac.wordpress.org/ for updates). Until a fix is released, WordPress administrators should restrict access to the WordPress admin dashboard using IP whitelisting, implement Web Application Firewall (WAF) rules to block requests to plugin settings pages from untrusted sources, enforce strong authentication mechanisms such as two-factor authentication (2FA), and educate administrators to avoid clicking suspicious links from untrusted sources. Additionally, review all active snippets in the plugin settings before removal to identify any unauthorized code injection that may have already occurred. See Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d96d1f33-43b3-4e20-967e-988cb32b04ee?source=cve for more details.