What is the CVSS score of CVE-2026-7616?

CVE-2026-7616 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Zawgyi Embed CVE-2026-7616

EUVD-2026-29418 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-12 Wordfence

GHSA-qq59-35mv-cmj8

PHP CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:47 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The Zawgyi Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the zawgyi_adminpage function. This makes it possible for unauthenticated attackers to update the plugin's zawgyi_forceCSS setting by submitting a forged POST request to options-general.php?page=zawgyi_embed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Zawgyi Embed WordPress plugin versions up to 2.1.1 allows unauthenticated attackers to modify the plugin's zawgyi_forceCSS setting by tricking a site administrator into clicking a malicious link. The vulnerability stems from missing nonce validation in the zawgyi_adminpage function, enabling attackers to submit forged POST requests to the plugin's settings page without the administrator's knowledge.

Technical ContextAI

The Zawgyi Embed plugin (identified via CPE cpe:2.3:a:saturngod:zawgyi_embed:*:*:*:*:*:*:*:*) implements a settings management function (zawgyi_adminpage) in its adminpanel.php file that processes configuration changes. The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), which occurs when the plugin fails to implement WordPress nonce validation mechanisms. WordPress nonces are cryptographic tokens that verify legitimate requests originating from authorized administrators, preventing CSRF attacks. The absence of nonce checks on the POST handler for the options-general.php settings page allows an attacker to craft a forged request that, when clicked by an authenticated administrator, will execute unintended actions on the plugin configuration without the administrator's explicit consent.

RemediationAI

Update the Zawgyi Embed plugin to a patched version beyond 2.1.1. Site administrators should navigate to WordPress Plugins > Installed Plugins and click 'Update Now' on the Zawgyi Embed plugin entry once a fixed version is available from the plugin developer. In the interim, administrators can reduce exposure by restricting access to wp-admin/ and the plugin settings page to trusted IP addresses via web server configuration (.htaccess for Apache or nginx rules), or by disabling the plugin entirely if the Zawgyi font functionality is not critical. Additionally, implement WordPress security best practices including enabling two-factor authentication for administrator accounts, using security plugins like Wordfence to monitor for CSRF attempts, and educating administrators never to click suspicious links while logged into WordPress. The patch must restore proper nonce validation to the zawgyi_adminpage function via wp_verify_nonce() before processing POST requests.