What is the CVSS score of CVE-2026-8419?

CVE-2026-8419 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Amazon Scraper CVE-2026-8419

EUVD-2026-31037 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-20 Wordfence

GHSA-65q3-p2qh-2c5j

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:38 vuln.today

DescriptionCVE.org

The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Amazon Scraper WordPress plugin (submone, all versions through 1.1) allows unauthenticated remote attackers to modify plugin settings and inject persistent malicious scripts by tricking an authenticated site administrator into clicking a crafted link. The root cause is missing or incorrect nonce validation across multiple functions in amazon-admin.php (identified at lines 13, 26, 45, and 49). No public exploit has been identified at time of analysis, and the plugin has not been added to the CISA KEV catalog, but the Wordfence-reported disclosure includes direct source code references making exploitation straightforward for a motivated attacker.

Technical ContextAI

The affected component is the Amazon Scraper WordPress plugin by submone (CPE: cpe:2.3:a:submone:amazon_scraper:*:*:*:*:*:*:*:*), which scrapes Amazon product data for display on WordPress sites. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), a class of flaw where the server fails to verify that a state-changing HTTP request originated from a legitimate, intentional action by the authenticated user. WordPress provides a built-in nonce (number used once) mechanism specifically to prevent CSRF; the plugin's admin handler file amazon-admin.php lacks or incorrectly implements this check at multiple function entry points (lines 13, 26, 45, and 49 per the Wordfence source references). Because admin actions in WordPress are scoped to the authenticated session cookie, any forged POST request that reaches those handler functions will execute with full admin-level plugin privileges, enabling settings changes and stored script injection without the nonce barrier.

RemediationAI

No vendor-released patch has been identified at time of analysis - the provided references point only to the vulnerable source code in the plugin's Subversion repository and the Wordfence advisory, with no patched release version confirmed. Site administrators should immediately deactivate and uninstall the Amazon Scraper plugin until a patched version is released, as this is the most reliable compensating control. If the plugin functionality is business-critical, restrict access to the WordPress admin panel to trusted IP ranges using server-level controls (nginx/Apache allowlist or WAF rules) to reduce the attack surface for CSRF forged requests, noting that this does not eliminate the vulnerability but requires the attacker to also have network proximity or bypass the IP restriction. Additionally, configure a Web Application Firewall rule to block requests to the plugin's admin endpoints that lack a valid WordPress nonce header. Monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c956e4c5-bf7e-4ec4-b795-74d477a61694 for a patched release.