What is the CVSS score of CVE-2026-6401?

CVE-2026-6401 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Bottom Bar CVE-2026-6401

EUVD-2026-31039 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-20 Wordfence

GHSA-3rp8-xffc-p7wp

WordPress PHP CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:36 vuln.today

DescriptionCVE.org

The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.1.7. This is due to missing nonce verification on the plugin's settings update forms handled in bottom-bar-admin.php. None of the three settings forms (main settings, sharing services, restore defaults) include a wp_nonce_field(), and the server-side processing code never calls check_admin_referer() or any equivalent nonce validation before processing POST data and calling update_option(). This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a crafted request that updates plugin configuration options, such as changing the language, maximum post counts, or enabled sharing services.

AnalysisAI

Cross-Site Request Forgery in the Bottom Bar WordPress plugin (all versions up to and including 0.1.7) allows unauthenticated attackers to modify plugin configuration by tricking a logged-in administrator into visiting a malicious page. All three administrative settings forms - main settings, sharing services, and restore defaults - lack both wp_nonce_field() output and server-side check_admin_referer() validation in bottom-bar-admin.php, meaning any POST to those endpoints is processed without request authenticity checks. No public exploit has been identified at time of analysis, no patched version has been confirmed, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The Bottom Bar plugin (CPE: cpe:2.3:a:svil4ok:bottom_bar:*:*:*:*:*:*:*:*) is a PHP-based WordPress plugin developed by svil4ok. The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), a class of web application flaw where the server fails to distinguish between intentional and forged requests originating from authenticated user sessions. WordPress's built-in CSRF protection relies on nonce tokens: forms must emit a hidden field via wp_nonce_field(), and corresponding handlers must verify it with check_admin_referer() or wp_verify_nonce(). The affected file bottom-bar-admin.php omits both mechanisms across all three settings handlers - confirmed at lines L16 and L59 in the plugin source tree for both the current trunk and the 0.1.7 tagged release - leaving every POST-based settings update open to cross-origin forgery.

RemediationAI

No vendor-released patch has been identified at time of analysis. Site administrators running the Bottom Bar plugin should consider deactivating and removing it until a patched release is published, as no safe in-plugin configuration workaround exists. If removal is not immediately possible, restricting wp-admin access to trusted IP ranges at the server or firewall level reduces the attack surface by limiting which authenticated sessions can be targeted - though this does not eliminate the underlying flaw and may impede legitimate remote administration. WordPress administrators should also practice general CSRF hygiene: avoid browsing untrusted sites while authenticated to the WordPress dashboard. Plugin developers should remediate by adding wp_nonce_field() to each of the three affected settings forms and calling check_admin_referer() at the start of each corresponding POST handler in bottom-bar-admin.php (source lines L16 and L59 as referenced by Wordfence). Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/db0715ed-a06e-4a68-b9c3-408887cae113 for patch release announcements.