What is the CVSS score of CVE-2026-6710?

CVE-2026-6710 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Skysa Text Ticker App CVE-2026-6710

EUVD-2026-29409 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-12 Wordfence

GHSA-r9m4-qq2r-5j55

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:48 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the SkysaApps_Admin_AppPage function. This makes it possible for unauthenticated attackers to trick a site administrator into making a forged request to modify the plugin's settings, including the scrolling message text and URL, via a forged cross-site request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery (CSRF) in the Skysa Text Ticker App plugin for WordPress affects all versions up to 1.4, allowing unauthenticated attackers to modify plugin settings including scrolling message text and URLs by tricking site administrators into clicking a malicious link. The vulnerability stems from missing nonce validation in the SkysaApps_Admin_AppPage function, enabling attackers to alter ticker content without authentication but requiring user interaction via social engineering.

Technical ContextAI

The vulnerability exists in the WordPress plugin architecture where the SkysaApps_Admin_AppPage function processes administrative actions without proper Cross-Site Request Forgery (CSRF) token validation. WordPress uses nonce tokens (number used once) as a standard CSRF mitigation mechanism to verify that form submissions originate from the legitimate application rather than attacker-controlled sites. The absence of nonce verification on the affected admin function allows attackers to craft malicious web pages that, when visited by an authenticated administrator, silently submit forged requests to modify plugin configuration. This affects the Skysa Text Ticker App (CPE: cpe:2.3:a:davidskysa:skysa_text_ticker_app:*:*:*:*:*:*:*:*) across all versions through 1.4. The root cause is categorized under CWE-352 (Cross-Site Request Forgery), a critical class of vulnerabilities that exploits the implicit trust between administrators and legitimate website origins.

RemediationAI

Update the Skysa Text Ticker App plugin to a version newer than 1.4 if a patched release is available from the plugin developer. If no patched version exists, the primary mitigation is to disable or remove the plugin entirely until a security update is released. Site administrators should audit their WordPress user accounts and limit administrative privileges to trusted personnel only, enforcing strong password policies and multi-factor authentication on admin accounts to reduce the surface area for social engineering attacks. Additionally, implement a Web Application Firewall (WAF) rule to detect and block requests to the vulnerable admin.php endpoint if the malicious request parameters can be identified. Monitor admin activity logs for unauthorized plugin setting modifications and restrict administrator access to trusted networks via IP whitelisting if operationally feasible. Wordfence and other WordPress security plugins may provide virtual patching rules to block CSRF requests targeting this specific function-check vendor advisories for available protection signatures.