EUVD-2026-31041
GHSA-p637-7ww8-j45c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a <textarea> element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.
AnalysisAI
Cross-Site Request Forgery chained to Stored Cross-Site Scripting in the Word 2 Cash WordPress plugin (versions ≤ 0.9.2) allows unauthenticated remote attackers to plant persistent JavaScript payloads inside the WordPress admin panel. The attack succeeds because the plugin's settings handler (w2c_admin()) performs no nonce verification, no input sanitization before storage, and no output escaping on retrieval - meaning a forged POST from any attacker-controlled page is indistinguishable from a legitimate admin save. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS score of 6.1 with Changed scope reflects real post-exploitation reach within the admin context once triggered.
Technical ContextAI
Word 2 Cash is a WordPress plugin by vendor 'winking' (CPE: cpe:2.3:a:winking:word_2_cash:*:*:*:*:*:*:*:*) that provides monetization functionality for written content. The root cause is CWE-352 (Cross-Site Request Forgery): the w2c_admin() function, which handles the plugin settings save operation, never calls WordPress's built-in wp_verify_nonce() or check_admin_referer() functions. This allows any origin to submit a valid-looking settings update on behalf of an authenticated admin. The secondary weakness is a stored XSS condition: the w2c-definitions POST parameter is passed directly to WordPress's update_option() without sanitization (e.g., sanitize_text_field() or wp_kses()), and later rendered inside a <textarea> element without escaping (e.g., esc_textarea()). The affected code paths are visible at word2cash.php lines 18, 20, and 31 in both the 0.9.2 tagged release and the current trunk, as confirmed by Wordfence's source code references.
RemediationAI
No vendor-released patch has been identified at time of analysis - the Wordfence advisory and WordPress plugin trac references do not indicate a fixed version, and the CPE uses an open-ended wildcard range. Site operators running Word 2 Cash ≤ 0.9.2 should immediately check the WordPress plugin directory for an updated release; if none exists, the most effective compensating control is to deactivate and remove the plugin entirely, eliminating the attack surface with no side effects beyond loss of the plugin's functionality. If the plugin cannot be removed, restrict access to the WordPress admin panel at the network or web server level (e.g., allowlist admin IPs via .htaccess or server configuration) to reduce the pool of exploitable admin sessions - note this does not eliminate the CSRF vector but significantly narrows it. Additionally, deploying a Web Application Firewall rule to block POST requests to the plugin's settings endpoint (wp-admin with the w2c-definitions parameter) can serve as a temporary control, though WAF bypass via encoding is possible. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c7ca5c-38aa-4413-83eb-29185cca2a74 for patch availability updates.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today