Dashboard Notes CVE-2026-62026

Exploitation requires an authenticated WordPress user with access to the Dashboard Notes plugin (realistically an administrator or privileged user, since the plugin manages dashboard content) to be logged in and then tricked into interacting with attacker-controlled content (UI:R) - for example clicking a link or loading a malicious page in the same browser. The limiting factors are: (1) a valid active session for a user with rights to the targeted plugin action, (2) the required victim interaction, and (3) the root cause being absent or improperly validated CSRF nonces on the plugin's state-changing endpoints. There is no server-side authentication barrier for the attacker themselves (PR:N), but there is no silent remote exploitation - it cannot succeed without the victim's authenticated browser.

This is a Cross-Site Request Forgery (CWE-352) flaw in the WordPress plugin Dashboard Notes (versions up to and including 1.0.3), scored CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The network attack vector and low complexity raise the headline score, but two signals pull real-world risk down: UI:R means a logged-in victim (typically an administrator) must be tricked into visiting a malicious page while authenticated, and the impacts are only Low across confidentiality, integrity and availability rather than a full compromise. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The PR:N is characteristic of CSRF scoring (the attacker holds no privileges; the victim's own session supplies them), so despite PR:N this is NOT unauthenticated server-side RCE - it is social-engineering-dependent. The S:C (scope change) and the triad of Low impacts are consistent with Patchstack's typical CSRF ratings. Net assessment: a genuine but second-tier issue - meaningful for sites running this plugin, but gated by user interaction and limited to partial impact, making it lower priority than a KEV-listed or unauthenticated-RCE flaw. Note the single data source (Patchstack) and absence of EPSS/KEV limit corroboration.

An attacker crafts a malicious web page or email link and lures a logged-in Dashboard Notes administrator into opening it while their WordPress session is active. The forged request silently performs a state-changing action in the plugin (e.g., creating or modifying dashboard notes) using the victim's authenticated session, because the plugin lacks anti-CSRF nonce validation. No public proof-of-concept is referenced, and success depends on the victim being authenticated and interacting with the attacker's content (UI:R).