What is the CVSS score of CVE-2026-7561?

CVE-2026-7561 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Tm - WordPress Redirection CVE-2026-7561

EUVD-2026-29416 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-12 Wordfence

GHSA-ww35-qh5h-4ccf

CSRF WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:47 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.1

DescriptionCVE.org

The Tm - WordPress Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery (CSRF) in Tm - WordPress Redirection plugin for WordPress versions up to 1.2 allows unauthenticated attackers to update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a malicious link. The vulnerability stems from missing or incorrect nonce validation on sensitive functions, enabling attackers to forge requests that execute administrative actions without the admin's explicit consent. CVSS score is 6.1 with network attack vector and low complexity, though exploitation requires user interaction (tricking administrator). No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability resides in the Tm - WordPress Redirection plugin's failure to implement proper CSRF token validation (nonces) on administrative functions. WordPress nonces are cryptographic tokens used to verify that requests originate from legitimate, authenticated sources and prevent cross-site request forgery attacks. The affected code points (lines 168, 265, and 308 in tm-redirect.php) handle settings updates without verifying nonce parameters. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), which occurs when an attacker crafts a forged HTTP request that executes privileged operations in the context of an authenticated administrator session. This type of vulnerability is particularly dangerous in WordPress because administrators have broad permissions to modify site configuration, install plugins, and modify content.

RemediationAI

The primary remediation is to update the Tm - WordPress Redirection plugin to a version newer than 1.2 that includes nonce validation fixes. Site administrators should navigate to the WordPress plugins dashboard, locate Tm - WordPress Redirection, and update to the patched version immediately. If no patched version is available, the plugin should be deactivated and removed from the site until a security update is released. As a temporary compensating control, administrators can restrict access to WordPress admin pages using web application firewall rules or htaccess restrictions to limit who can be tricked into clicking malicious links, though this is not a substitute for the patch. Additionally, implementing Content Security Policy (CSP) headers can help mitigate the impact of injected malicious scripts if exploitation occurs. Site administrators should review plugin change logs and the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/82caf69a-2423-4f0f-9cf2-7d4fe428e915 for patch availability and timeline.