What is the CVSS score of CVE-2026-6391?

CVE-2026-6391 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Sentence To SEO CVE-2026-6391

EUVD-2026-31031 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-20 Wordfence

GHSA-mhrr-39v8-vjrr

WordPress CSRF

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:34 vuln.today

DescriptionCVE.org

The Sentence To SEO (keywords, description and tags) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the create_admin_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts and update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Sentence To SEO WordPress plugin (all versions up to and including 1.0) allows unauthenticated remote attackers to inject persistent malicious scripts and overwrite plugin settings by forging admin form submissions against the unprotected create_admin_page() function. Because the CVSS vector carries Changed scope (S:C), a successfully forged request can achieve Stored XSS within the WordPress admin context, crossing the boundary from the plugin into the administrator's browser session. No public exploit code or active exploitation has been identified at time of analysis, and no KEV listing exists, but the attack class is well-understood and exploitation templates for WordPress CSRF-to-XSS chains are widely available.

Technical ContextAI

The affected code is the 'Sentence To SEO (keywords, description and tags)' plugin by eazyserver (CPE: cpe:2.3:a:eazyserver:sentence_to_seo_(keywords,_description_and_tags):*:*:*:*:*:*:*:*), a WordPress plugin providing automated SEO metadata generation. WordPress's security model requires that all state-changing admin form handlers verify a nonce - a one-time cryptographic token - using wp_verify_nonce() or check_admin_referer() to ensure submissions originate from the legitimate admin interface rather than a forged third-party page. The create_admin_page() function, whose source is visible in the WordPress Plugin Repository Trac at index.php lines 50, 75, 81, and 87 for both the trunk and the tagged 1.0 release, omits this validation entirely. This maps to CWE-352 (Cross-Site Request Forgery) at the root cause level. The secondary impact - script injection - arises because the same function handles rendering of admin-facing content, so attacker-supplied values submitted via the forged request can persist and execute as Stored XSS on subsequent admin page loads.

RemediationAI

No vendor-released patched version has been identified in the available data - the WordPress Plugin Repository Trac references confirm the vulnerable code is present in both the trunk and the 1.0 tagged release, with no evidence of a subsequent fixed release. The primary recommended action is to deactivate and remove the Sentence To SEO plugin immediately, accepting the loss of its SEO automation functionality until a patched version is confirmed and published. As a compensating control in environments where the plugin cannot be immediately removed, restricting WordPress admin dashboard access (wp-admin) to trusted IP ranges at the server or WAF level reduces the pool of administrator sessions that can be targeted by CSRF - note that this control does not eliminate the vulnerability but significantly raises the bar for exploitation. A WAF with WordPress CSRF rulesets (such as the Wordfence plugin's own firewall, or a network-edge WAF) can inspect and block forged cross-origin POST requests as an additional layer. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/add32c06-90d0-466f-b176-aaae55cf03fb and the WordPress plugin page for patch availability.