What is the CVSS score of CVE-2026-4141?

CVE-2026-4141 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4141

EUVD-2026-20109 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-08 Wordfence

GHSA-jpg5-qfwx-chrw

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20109

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

MEDIUM 4.3

DescriptionCVE.org

The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation in the quran_playlist_options() function that handles the plugin's settings page. The function processes POST requests to update plugin options via update_option() without any wp_nonce_field() in the form or wp_verify_nonce()/check_admin_referer() verification before processing. This makes it possible for unauthenticated attackers to modify plugin settings (toggling display options for PDF, RSS, podcast, media player links, playlist title, and playlist code) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery (CSRF) in the Quran Translations WordPress plugin versions up to 1.7 allows unauthenticated attackers to modify plugin settings by tricking site administrators into clicking a malicious link. The vulnerability stems from missing nonce validation in the quran_playlist_options() function, which processes POST requests to update options like PDF, RSS, podcast, and media player display settings without cryptographic request verification. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The Quran Translations plugin (CPE: cpe:2.3:a:edckwt:quran_translations:*:*:*:*:*:*:*:*) implements a settings form handler in the quran_playlist_options() function that directly calls update_option() to persist user-configurable display toggles. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), a foundational web security issue where state-changing operations lack protection against cross-origin request forgery. The plugin fails to implement WordPress's standard CSRF mitigation mechanisms: wp_nonce_field() to embed a token in the HTML form and wp_verify_nonce() or check_admin_referer() to validate the token on POST receipt. This allows any attacker to craft an HTML page containing a hidden form that, when visited by an authenticated administrator, silently submits forged requests to update plugin configuration, bypassing the administrative intent requirement.

RemediationAI

Site administrators should immediately upgrade the Quran Translations plugin to version 1.8 or later, which includes nonce validation fixes. The patch adds wp_nonce_field() to the settings form and implements wp_verify_nonce() or check_admin_referer() verification before processing option updates. To apply the fix, navigate to the WordPress Plugins dashboard, locate 'Quran Translations by EDC', and click 'Update' if available; if an update is not displayed, manually download the latest version from https://plugins.wordpress.org/plugins/quran-translations-by-edc/ and reinstall. As an interim workaround pending an update (if unavailable), site administrators can restrict plugin settings page access to trusted IP ranges via their web server configuration or Web Application Firewall, or disable the plugin until a patched version is released. No vendor-released patch information is confirmed in the provided input; administrators should verify version 1.8+ availability directly with the plugin author or via the WordPress plugin repository.