What is the CVSS score of CVE-2026-7614?

CVE-2026-7614 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Old Posts Highlighter CVE-2026-7614

EUVD-2026-32085 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-27 security@wordfence.com

GHSA-99wg-66gf-8437

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:35 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the OPH_options function. This makes it possible for unauthenticated attackers to update the plugin's configuration settings without authorization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Old Posts Highlighter WordPress plugin (all versions ≤1.0.3) enables unauthenticated network attackers to modify the plugin's configuration settings without authorization, provided they can socially engineer an authenticated site administrator into clicking a crafted link. The root cause is missing or incorrect WordPress nonce validation in the OPH_options function within OPH_admin.php, a standard anti-CSRF control in the WordPress plugin ecosystem. No public exploit has been identified at time of analysis, and the EPSS score of 0.01% (2nd percentile) reflects minimal observed exploitation pressure.

Technical ContextAI

The vulnerability resides in the OPH_options function defined in OPH_admin.php (lines 37 and 163 per the Wordfence and NVD trac references). WordPress relies on cryptographic nonces - time-limited tokens tied to a user session - to authenticate plugin settings form submissions and prevent forged cross-origin requests. CWE-352 (Cross-Site Request Forgery) describes a class of flaws where a server-side action accepts requests without verifying that they originated from a legitimate, user-initiated interaction. When nonce validation is absent or improperly implemented, any network-accessible webpage can silently submit a form to the WordPress admin endpoint on behalf of a logged-in administrator, causing the server to process it as legitimate. The affected plugin is a WordPress extension, meaning exploitation targets the WordPress admin-ajax or options-saving endpoint rather than a standalone service.

RemediationAI

The primary remediation is to update the Old Posts Highlighter plugin to a version that introduces proper WordPress nonce validation in the OPH_options function. NVD references include the plugin's trunk branch of OPH_admin.php (distinct from the 1.0.3 tag), suggesting a fix has been committed to the development trunk; however, a specific patched release version has not been independently confirmed from the available data - administrators should check the WordPress plugin repository for a version newer than 1.0.3 before upgrading. If no patched release is yet available, a compensating control is to deactivate and remove the Old Posts Highlighter plugin until a fix ships, eliminating the attack surface entirely with no functional trade-off beyond the loss of the plugin's display features. Alternatively, a Web Application Firewall rule that blocks cross-origin POST requests to WordPress admin settings endpoints (wp-admin/options.php or admin-ajax.php with the relevant action) can reduce CSRF risk across plugins, though this may interfere with legitimate third-party integrations and requires tuning.