What is the CVSS score of CVE-2026-4002?

CVE-2026-4002 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4002

EUVD-2026-22867 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-15 Wordfence

GHSA-hx42-ggr3-3hp6

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 09:08 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 09:00 euvd

EUVD-2026-22867

Analysis Generated

Apr 15, 2026 - 09:00 vuln.today

CVE Published

Apr 15, 2026 - 08:28 nvd

MEDIUM 4.3

DescriptionCVE.org

The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8. This is due to missing nonce validation in the ajax_revoke_token() function which handles the 'petjeaf_disconnect' AJAX action. The function performs destructive operations including revoking OAuth2 tokens, deleting user meta, and deleting WordPress user accounts (for users with the 'petjeaf_member' role) without verifying the request originated from a legitimate source. This makes it possible for unauthenticated attackers to force authenticated users to delete their Petje.af member user accounts via a forged request granted the victim clicks on a link or visits a malicious site.

AnalysisAI

Cross-site request forgery in Petje.af WordPress plugin versions up to 2.1.8 allows unauthenticated attackers to force authenticated users into destructive actions-including revoking OAuth2 tokens, deleting user metadata, and permanently removing WordPress user accounts with the 'petjeaf_member' role-by crafting malicious requests that bypass nonce validation in the ajax_revoke_token() AJAX handler. The vulnerability requires user interaction (victim must click a link or visit a malicious site) but carries moderate integrity impact due to the ability to delete user accounts.

Technical ContextAI

The Petje.af plugin implements OAuth2 token management through the ajax_revoke_token() function in the class-petje-af-oauth2-provider.php file, which is exposed as a WordPress AJAX action handler for the 'petjeaf_disconnect' action. WordPress AJAX handlers must validate requests using cryptographic nonces (one-time tokens) to prevent cross-site request forgery attacks. CWE-352 (Cross-Site Request Forgery) describes exactly this failure: allowing state-changing operations without verifying that the request originated from an authorized user session. The missing nonce validation means any attacker can construct a forged HTTP request or embed it in a webpage, and if an authenticated WordPress user visits that page while logged in, the browser will automatically attach the user's session cookies, allowing the attacker's request to execute with the victim's privileges.

RemediationAI

Update the Petje.af plugin to a patched version released after 2.1.8 through the WordPress plugin dashboard (Plugins > Installed Plugins > Petje.af > Update Now) or manually via wp-content/plugins/. If a patched version is not yet available, deactivate and remove the plugin from Settings > Plugins until a fix is released. Site administrators should review the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/28a071ac-37ee-4fb9-b8c6-0a782ee673b4?source=cve for confirmation of patch availability and any temporary mitigation guidance. Additionally, administrators should audit user accounts, particularly those with the 'petjeaf_member' role, to check for unexpected deletions.