EUVD-2026-34926
GHSA-pjrp-wx6v-7795
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the funp_ajax_modify_notes function. This makes it possible for unauthenticated attackers to trick a logged-in user into visiting a malicious page, causing unauthorized overwriting of that victim's own note content via a forged cross-site request to wp_update_post() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to ownership enforcement comparing the note's stored _funp_single_user_id meta against the current session's user ID, the attack is limited to modifying only notes belonging to the tricked victim, and cannot be used to alter notes owned by arbitrary third-party users.
AnalysisAI
Cross-Site Request Forgery in the Frontend User Notes WordPress plugin (all versions through 2.1.1) allows unauthenticated remote attackers to trick an authenticated victim into overwriting their own note content. The funp_ajax_modify_notes function lacks proper nonce validation, enabling forged requests to invoke wp_update_post() on behalf of the logged-in victim. No public exploit has been identified at time of analysis, and the attack's impact is bounded by ownership enforcement: only the tricked victim's own notes can be altered, not those of arbitrary third-party users.
Technical ContextAI
CWE-352 (Cross-Site Request Forgery) describes state-changing operations that rely solely on session-based authentication without a secondary request-origin token. In WordPress, the standard defense is nonce validation via wp_verify_nonce(). The funp_ajax_modify_notes AJAX handler at includes/ajax.php (lines 108 and 157 in the 2.1.1 tag) bypasses this check, allowing any cross-origin POST request carrying a valid session cookie to invoke wp_update_post(). Ownership is partially enforced through comparison of the _funp_single_user_id post meta against the current session's user ID, which prevents horizontal escalation to other users' notes but does not prevent the CSRF vector itself. The affected plugin is the Frontend User Notes plugin for WordPress, confirmed via Wordfence threat intelligence and the WordPress plugin Trac repository.
RemediationAI
An upstream fix has been committed to the plugin's trunk repository via changeset 3559955 (https://plugins.trac.wordpress.org/changeset/3559955/), which addresses the missing nonce validation in funp_ajax_modify_notes. However, an exact released and tagged patched version number is not independently confirmed from the available input data - administrators should verify the current version in the WordPress Plugin Directory and update if a version beyond 2.1.1 is available. As a compensating control prior to patching, administrators can deactivate the Frontend User Notes plugin to eliminate the attack surface entirely; the trade-off is loss of the plugin's note-taking functionality for frontend users. Restricting AJAX endpoints via a Web Application Firewall to block cross-origin POST requests to wp-admin/admin-ajax.php targeting the funp_ajax_modify_notes action is a secondary mitigation, though this may affect legitimate plugin functionality and requires careful WAF rule tuning.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today