What is the CVSS score of CVE-2026-3565?

CVE-2026-3565 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Taqnix WordPress Plugin CVE-2026-3565

EUVD-2026-25405 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-24 Wordfence

GHSA-g4r7-2w2r-848v

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 08:30 vuln.today

EUVD ID Assigned

Apr 24, 2026 - 08:00 euvd

EUVD-2026-25405

Analysis Generated

Apr 24, 2026 - 08:00 vuln.today

CVE Published

Apr 24, 2026 - 07:45 nvd

MEDIUM 4.3

DescriptionCVE.org

The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to a missing nonce verification in the taqnix_delete_my_account() function, where the check_ajax_referer() call is explicitly commented out on line 883. This makes it possible for unauthenticated attackers to trick a logged-in non-administrator user into deleting their own account via a forged request granted they can trick the user into performing an action such as clicking a link or visiting a malicious page.

AnalysisAI

Cross-Site Request Forgery (CSRF) in Taqnix WordPress plugin versions up to 1.0.3 allows unauthenticated attackers to trick logged-in users into deleting their own accounts via a forged request. The vulnerability stems from a commented-out nonce verification check in the taqnix_delete_my_account() function, making account deletion unprotected against CSRF attacks. No public exploit code or active exploitation has been identified, though the attack requires user interaction (clicking a malicious link or visiting a compromised page).

Technical ContextAI

The Taqnix plugin uses WordPress AJAX to handle user account deletion via the taqnix_delete_my_account() function. WordPress's standard CSRF protection mechanism, check_ajax_referer(), generates and validates nonce tokens to ensure requests originate from legitimate sources. The vulnerability exists because this nonce verification call is explicitly commented out at line 883 in the affected versions, leaving the AJAX endpoint unprotected. The CWE-352 classification confirms this is a missing CSRF token validation issue. Unauthenticated attackers can craft malicious HTML or JavaScript that triggers the deletion endpoint when a logged-in user visits an attacker-controlled page, exploiting the lack of origin verification.

RemediationAI

Update Taqnix to a patched version released after 1.0.3 that re-enables nonce verification via check_ajax_referer() in the taqnix_delete_my_account() function. This fix is confirmed as available in the plugin repository trunk (development version). Site administrators should update from the WordPress plugin dashboard or download the latest version from plugins.wordpress.org/plugins/taqnix/. The nonce verification check must be uncommented or re-implemented to validate the WordPress nonce token before processing account deletion requests. No workarounds are available for unpatched installations; the vulnerability cannot be mitigated through configuration alone. If immediate patching is not possible, administrators can restrict plugin access via .htaccess or Web Application Firewall rules, though this may disable intended plugin functionality.