What is the CVSS score of CVE-2026-3331?

CVE-2026-3331 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3331?

Organizations using for WordPress is vulnerable to Cross-Site Request Forgery in should be aware of moderate risk from CVE-2026-3331, a cross-site request forgery vulnerability rated CVSS 4.3.. A patch is available.

How to fix or mitigate CVE-2026-3331?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Cross-Site Request Forgery in and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

WordPress CVE-2026-3331

EUVD-2026-14182 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-21 Wordfence

GHSA-37g4-qqqv-7m99

GHSA-47cr-f226-r4pq

GHSA-7r28-6j42-p3gg

GHSA-mr3j-p26x-72x4

GHSA-mr9r-mww3-v6gv

GHSA-q485-cg9q-xq2r

GHSA-vq4q-79hh-q767

GHSA-w5ff-2mjc-4phc

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14182

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 4.3

DescriptionCVE.org

The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing or incorrect nonce validation on the fourty_slider_options_page function. This makes it possible for unauthenticated attackers to modify plugin slider-page configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

The Lobot Slider Administrator WordPress plugin (versions up to 0.6.0) contains a Cross-Site Request Forgery (CSRF) vulnerability in the fourty_slider_options_page function due to missing or incorrect nonce validation. This allows unauthenticated attackers to modify plugin slider-page configuration by tricking site administrators into clicking malicious links, potentially altering slider settings and website presentation. The vulnerability carries a moderate CVSS score of 4.3 with low attack complexity, requiring only user interaction and no privileges.

Technical ContextAI

This vulnerability exploits a fundamental web security weakness classified as CWE-352 (Cross-Site Request Forgery), where state-changing operations lack proper anti-CSRF token validation. The Lobot Slider Administrator plugin (CPE: cpe:2.3:a:chuckmo:lobot_slider_administrator:*:*:*:*:*:*:*:*) implements a WordPress admin function (fourty_slider_options_page) that processes slider configuration changes without verifying WordPress security nonces—cryptographic tokens that ensure requests originate from legitimate admin sessions. WordPress nonces are the standard CSRF mitigation mechanism for plugins; their absence or improper implementation in capability-restricted pages permits arbitrary modification of plugin settings through forged cross-origin requests. The vulnerability affects the plugin's core administrative interface as evidenced by the plugin file itself (lobot-slider-administrator.php) referenced in the WordPress plugin repository at lines indicating the vulnerable function.

RemediationAI

Site administrators must upgrade the Lobot Slider Administrator plugin to a version after 0.6.0 that includes proper nonce validation in the fourty_slider_options_page function; check the WordPress plugin repository or vendor release notes for patched versions. If a patched version is unavailable or the plugin is abandoned, disable and remove the plugin entirely, as CSRF vulnerabilities in low-maintenance plugins cannot be safely mitigated through access controls alone. As a temporary workaround pending plugin removal, restrict administrative access to the slider configuration pages by implementing IP allowlisting on the WordPress admin interface via firewall or .htaccess rules, and educate administrators to avoid clicking suspicious links while logged into WordPress. Verify plugin status at https://plugins.trac.wordpress.org/browser/lobot-slider-administrator/ for any available updates or security notices.