What is the CVSS score of CVE-2026-6396?

CVE-2026-6396 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Fast & Fancy Filter - 3F CVE-2026-6396

EUVD-2026-24707 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-22 Wordfence

GHSA-4922-xr68-xjg8

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:01 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24707

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.3

DescriptionCVE.org

The Fast & Fancy Filter - 3F plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce verification in the saveFields() function, which handles the fff_save_settins AJAX action. This makes it possible for unauthenticated attackers to modify plugin filter settings, update arbitrary options, or create new filter posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in Fast & Fancy Filter - 3F WordPress plugin up to version 1.2.2 allows unauthenticated attackers to modify plugin filter settings, update arbitrary site options, or create filter posts by tricking site administrators into clicking a malicious link. The vulnerability exists in the saveFields() function which handles the fff_save_settins AJAX action without nonce verification, enabling attackers to forge requests that execute administrative actions on behalf of logged-in administrators.

Technical ContextAI

The Fast & Fancy Filter - 3F plugin registers an AJAX endpoint (fff_save_settins) via WordPress hooks that processes administrative changes to filter configurations. The underlying vulnerability is a classic Cross-Site Request Forgery (CWE-352) stemming from the absence of nonce token validation in the saveFields() function. WordPress nonces are cryptographic tokens that prevent CSRF attacks by validating that state-changing requests originate from legitimate users within the application, not from external malicious sites. Without nonce verification, an attacker can craft a webpage or email containing a forged request that, when visited by an authenticated administrator, causes the WordPress application to execute privileged actions under that administrator's context. The affected CPE indicates the vulnerability impacts all versions of the plugin through and including 1.2.2.

RemediationAI

Upgrade Fast & Fancy Filter - 3F to a version greater than 1.2.2 once a patched release is available from the plugin author. Wordfence and the WordPress plugin repository should be monitored for a security update that adds nonce verification to the saveFields() function and the fff_save_settins AJAX handler. As an immediate compensating control, site administrators should disable the plugin entirely if it is not actively required, or restrict plugin access by implementing strict WordPress user role controls, limiting administrator accounts to trusted personnel only, and educating administrators about phishing and malicious link risks. Alternatively, a Web Application Firewall (WAF) rule blocking POST requests to wp-admin/admin-ajax.php with action=fff_save_settins from external referrers may reduce attack surface, though this may interfere with legitimate administrative workflows if administrators use the plugin from external locations. These controls are temporary; patching is the permanent fix.