What is the CVSS score of CVE-2026-4071?

CVE-2026-4071 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

BirdSeed WordPress Plugin CVE-2026-4071

EUVD-2026-33888 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-02 Wordfence

GHSA-7cjh-gmfx-r7gg

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 08:48 vuln.today

CVE Published

Jun 02, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The BirdSeed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing nonce validation in the birdseed_plugin_settings_page() function. The function processes the 'birdseed_token' GET parameter and saves it to the database via update_option() without verifying a nonce. This makes it possible for unauthenticated attackers to change the plugin's BirdSeed token setting via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

AnalysisAI

Cross-Site Request Forgery in the BirdSeed WordPress plugin (all versions up to and including 2.2.0) enables unauthenticated remote attackers to overwrite the plugin's API token by tricking an authenticated site administrator into clicking a crafted link. The vulnerability stems from birdseed_plugin_settings_page() accepting the birdseed_token GET parameter and persisting it via update_option() with no nonce verification, bypassing WordPress's standard CSRF protection entirely. No public exploit has been identified at time of analysis; CVSS rates this Medium (4.3) reflecting narrow integrity impact limited to token replacement.

Technical ContextAI

BirdSeed is a WordPress engagement and chat widget plugin (CPE: cpe:2.3:a:birdseedapp:birdseed:*:*:*:*:*:*:*:*) that uses an API token to authenticate with the BirdSeed platform. The root cause is CWE-352 (Cross-Site Request Forgery): WordPress's standard defense requires developers to call check_admin_referer() or verify_nonce() before processing any state-changing administrative action. The vulnerable function birdseed_plugin_settings_page() at birdseed.php lines 42-43 skips this step entirely, reading birdseed_token directly from the GET superglobal and passing it to update_option() unconditionally. Because the parameter is consumed via HTTP GET rather than POST, any hyperlink - not just a form submission - is sufficient to trigger the state change, making the attack surface particularly low-friction.

RemediationAI

No fixed version number is identified in the available intelligence - CPE data uses a wildcard upper bound and no advisory fix version is referenced, so patch availability cannot be confirmed at time of analysis. Administrators should immediately check the WordPress plugin repository for a version above 2.2.0 and update if available. If no patch exists, deactivating or removing the BirdSeed plugin eliminates the attack surface with no residual risk beyond loss of plugin functionality. If the plugin must remain active, restricting WordPress admin dashboard access via IP allowlisting (through .htaccess directives or a WAF rule such as Wordfence's built-in firewall) reduces the probability that an administrator session can be exploited via a forged link - the trade-off is that legitimate remote admin access would also be blocked. Wordfence firewall users should confirm their ruleset includes a signature for CVE-2026-4071. Do not rely solely on compensating controls if a vendor patch becomes available; verify the plugin repository regularly.