What is the CVSS score of CVE-2026-7615?

CVE-2026-7615 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Widget Context CVE-2026-7615

EUVD-2026-31415 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-22 Wordfence

GHSA-jrc7-p252-6hpq

WordPress PHP CSRF Widget Context

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 22, 2026 - 09:30 vuln.today

Analysis Generated

May 22, 2026 - 09:30 vuln.today

DescriptionCVE.org

The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is due to missing or incorrect nonce validation on the save_widget_context_settings function. This makes it possible for unauthenticated attackers to modify widget visibility context settings stored in the WordPress options table via a forged POST request to /wp-admin/widgets.php via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Widget Context WordPress plugin (all versions ≤ 1.3.3) allows unauthenticated attackers to modify widget visibility context settings stored in the WordPress options table by forging a POST request to /wp-admin/widgets.php. The root cause is missing or incorrect nonce validation in the save_widget_context_settings function, confirmed by Wordfence and corroborated by source code references at WidgetContext.php lines 91, 282, and 311. Exploitation requires social engineering a logged-in administrator into clicking an attacker-controlled link; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Widget Context (CPE: cpe:2.3:a:kasparsd:widget_context:*:*:*:*:*:*:*:*) is a PHP-based WordPress plugin that controls widget display based on page context, storing configuration in the WordPress options table. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery): the save_widget_context_settings function, exposed via a POST handler for /wp-admin/widgets.php, does not implement WordPress nonce validation. In WordPress, nonces (number-used-once tokens) are the standard CSRF defense mechanism for admin-area form submissions; their absence or incorrect implementation allows any forged POST request originating from an authenticated admin browser session to be accepted as legitimate. The affected code is visible in the plugin repository at WidgetContext.php lines 91, 282, and 311 across both the trunk and the 1.3.3 tagged release.

RemediationAI

An upstream fix has been submitted via GitHub Pull Request #73 (https://github.com/kasparsd/widget-context-wporg/pull/73); however, a released tagged version incorporating this fix has not been independently confirmed from the available data - administrators should monitor the WordPress plugin repository for an update beyond 1.3.3 and apply it immediately upon release. As a compensating control until a patched version is available, administrators can restrict access to /wp-admin/widgets.php via server-level rules (e.g., nginx location blocks or Apache mod_rewrite) to trusted IP ranges only, though this affects legitimate admin access. Additionally, ensuring administrators follow safe browsing hygiene - avoiding clicking unsolicited links while logged into the WordPress dashboard - directly mitigates the required UI:R condition. Disabling the plugin entirely eliminates exposure with the trade-off of losing widget context functionality.