EUVD-2026-22867
GHSA-hx42-ggr3-3hp6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8. This is due to missing nonce validation in the ajax_revoke_token() function which handles the 'petjeaf_disconnect' AJAX action. The function performs destructive operations including revoking OAuth2 tokens, deleting user meta, and deleting WordPress user accounts (for users with the 'petjeaf_member' role) without verifying the request originated from a legitimate source. This makes it possible for unauthenticated attackers to force authenticated users to delete their Petje.af member user accounts via a forged request granted the victim clicks on a link or visits a malicious site.
AnalysisAI
Cross-site request forgery in Petje.af WordPress plugin versions up to 2.1.8 allows unauthenticated attackers to force authenticated users into destructive actions-including revoking OAuth2 tokens, deleting user metadata, and permanently removing WordPress user accounts with the 'petjeaf_member' role-by crafting malicious requests that bypass nonce validation in the ajax_revoke_token() AJAX handler. The vulnerability requires user interaction (victim must click a link or visit a malicious site) but carries moderate integrity impact due to the ability to delete user accounts.
Technical ContextAI
The Petje.af plugin implements OAuth2 token management through the ajax_revoke_token() function in the class-petje-af-oauth2-provider.php file, which is exposed as a WordPress AJAX action handler for the 'petjeaf_disconnect' action. WordPress AJAX handlers must validate requests using cryptographic nonces (one-time tokens) to prevent cross-site request forgery attacks. CWE-352 (Cross-Site Request Forgery) describes exactly this failure: allowing state-changing operations without verifying that the request originated from an authorized user session. The missing nonce validation means any attacker can construct a forged HTTP request or embed it in a webpage, and if an authenticated WordPress user visits that page while logged in, the browser will automatically attach the user's session cookies, allowing the attacker's request to execute with the victim's privileges.
RemediationAI
Update the Petje.af plugin to a patched version released after 2.1.8 through the WordPress plugin dashboard (Plugins > Installed Plugins > Petje.af > Update Now) or manually via wp-content/plugins/. If a patched version is not yet available, deactivate and remove the plugin from Settings > Plugins until a fix is released. Site administrators should review the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/28a071ac-37ee-4fb9-b8c6-0a782ee673b4?source=cve for confirmation of patch availability and any temporary mitigation guidance. Additionally, administrators should audit user accounts, particularly those with the 'petjeaf_member' role, to check for unexpected deletions.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today