What is the CVSS score of CVE-2026-6701?

CVE-2026-6701 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

addfreespace WordPress Plugin CVE-2026-6701

EUVD-2026-27205 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-05 Wordfence

WordPress CSRF Wordpress Plugin Addfreespace

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:30 vuln.today

DescriptionCVE.org

The addfreespace plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in addfreespace WordPress plugin versions up to 0.1.3 allows unauthenticated attackers to update plugin settings and inject malicious scripts by tricking site administrators into clicking a forged link, exploiting missing nonce validation on settings update functions. The vulnerability requires user interaction (administrator click) and has low impact scope (integrity only, no confidentiality or availability loss), making it a moderate-risk CSRF attack vector in typical WordPress deployments.

Technical ContextAI

The addfreespace WordPress plugin fails to implement proper CSRF token validation (nonces) on administrative settings update functions. WordPress nonces are cryptographic tokens that verify requests originate from legitimate site administrators. The vulnerability exists in multiple plugin files (addfreespace.php and addfreespace_functions.php) across settings handling routines. CWE-352 (Cross-Site Request Forgery) occurs when the application does not properly validate that form submissions originate from the current user, allowing attackers to craft forged HTTP requests that execute privileged actions when an admin visits a malicious page. The affected plugin handles administrative functions without these protections, making it susceptible to CSRF attacks despite the plugin requiring WordPress admin access to modify settings.

RemediationAI

Update the addfreespace plugin to a version newer than 0.1.3 that includes nonce validation on all settings update functions. If no patched version is available from the vendor, disable the addfreespace plugin entirely via WordPress admin dashboard (Plugins > Installed Plugins > Deactivate) until a security update is released. As a compensating control, restrict access to the WordPress admin dashboard using IP whitelisting, Web Application Firewall rules blocking requests to /wp-admin/ from untrusted networks, or require multi-factor authentication for all administrator accounts to limit successful CSRF exploitation impact. Site administrators should also avoid clicking links from untrusted sources while logged into WordPress. Consult the Wordfence vulnerability report (https://www.wordfence.com/threat-intel/vulnerabilities/id/40eaeb28-c721-4977-951d-582b7dc2bd12) for patch availability confirmation and plugin update status.