What is the CVSS score of CVE-2026-6702?

CVE-2026-6702 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Publish 2 Ping.fm CVE-2026-6702

EUVD-2026-27207 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-05 Wordfence

PHP CSRF WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:31 vuln.today

DescriptionCVE.org

The Publish 2 Ping.fm plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the '/wp-admin/options-general.php?page=admin.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in Publish 2 Ping.fm WordPress plugin up to version 1.1 allows unauthenticated attackers to modify plugin settings and inject malicious scripts by tricking site administrators into clicking a crafted link, exploiting missing nonce validation on the admin settings page. The vulnerability requires user interaction (admin click) and affects the plugin's confidentiality and integrity but not availability. No public exploit code or active exploitation has been confirmed.

Technical ContextAI

The Publish 2 Ping.fm plugin (CPE: cpe:2.3:a:foux:publish_2_ping.fm:*:*:*:*:*:*:*:*) is a WordPress plugin that integrates Ping.fm social media posting functionality. WordPress plugins are PHP-based extensions that run with the privileges of the WordPress installation. The vulnerability stems from CWE-352 (Cross-Site Request Forgery / CSRF), a classic web vulnerability where an attacker forges a request that appears to come from an authenticated user. The plugin fails to implement or properly validate WordPress nonce tokens on the admin settings page (options-general.php?page=admin.php and related admin endpoints in php/admin.php and php/prefs.php). WordPress nonces are cryptographic tokens designed to prevent CSRF by ensuring that form submissions originate from the legitimate admin interface, not from attacker-controlled third-party sites.

RemediationAI

The primary remediation is to update the Publish 2 Ping.fm plugin to a patched version released after 1.1. Administrators should navigate to WordPress Dashboard → Plugins and check for available updates; the plugin author should have released a fixed version with proper nonce validation. If an update is not yet available, the most effective immediate mitigation is to deactivate and remove the plugin from the WordPress installation until a patch is available, as CSRF attacks against admin settings pose a direct risk to site integrity and security. Secondary controls include restricting WordPress admin access by IP address (via .htaccess or WAF rules) to limit the attack surface to known administrator locations, and implementing HTTP-only and SameSite cookie flags at the server level to reduce CSRF attack surface (though this does not fully mitigate missing nonce validation). Administrators should also educate themselves and site users not to click links while logged into WordPress admin, especially from untrusted sources. No workaround can fully substitute for the patch, as the vulnerability is in the plugin's core admin functionality.