What is the CVSS score of CVE-2026-6452?

CVE-2026-6452 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Bigfishgames Syndicate CVE-2026-6452

EUVD-2026-31021 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-20 Wordfence

GHSA-2pxx-cpw4-vfpq

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:36 vuln.today

DescriptionCVE.org

The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the bigfishgames_syndicate_submenu() function. This makes it possible for unauthenticated attackers to reset plugin settings and update them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Bigfishgames Syndicate WordPress plugin (all versions through 1.2) enables unauthenticated remote attackers to reset and overwrite plugin settings by forging admin-panel requests. The vulnerability resides in the bigfishgames_syndicate_submenu() function, which lacks proper WordPress nonce validation, meaning any crafted HTTP request bearing a valid admin session will be accepted as legitimate. Exploitation requires tricking an authenticated site administrator into triggering the forged request; no public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

WordPress uses cryptographic nonces as CSRF tokens - short-lived one-time values embedded in admin forms and verified server-side to confirm that a submitted action originated from a legitimate, authenticated user session. CWE-352 (Cross-Site Request Forgery) results when a server-side handler processes state-changing requests without verifying these tokens. Per the WordPress plugin repository source, the vulnerable code exists in bigfishgames_syndicate_submenu() at lines 169 and 238 of bigfishgames-syndicate.php, which handle plugin settings submission without invoking WordPress's check_admin_referer() or equivalent nonce verification. The affected product is identified by CPE cpe:2.3:a:ktulhu:bigfishgames_syndicate:*:*:*:*:*:*:*:* - vendor 'ktulhu', covering the plugin through version 1.2.

RemediationAI

No vendor-released patched version is confirmed in the available data - the CPE wildcard over the full version range and the absence of a fixed-version reference in any advisory suggest no patch has been published as of this analysis. Site administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/67877a2e-a45d-4674-b749-05d9217ef6bf?source=cve for patch release notifications. As an interim compensating control, deactivate the Bigfishgames Syndicate plugin if syndication functionality is not actively required; deactivation eliminates the attack surface entirely with no residual trade-off beyond lost feature use. If the plugin must remain active, restrict WordPress admin panel access to trusted IP ranges at the web server or WAF layer, reducing the administrative session exposure that CSRF exploits depend on. Wordfence firewall rules may also provide virtual patching for sites running Wordfence Premium.