What is the CVSS score of CVE-2026-8424?

CVE-2026-8424 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Remove Yellow BGBOX CVE-2026-8424

EUVD-2026-31032 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-20 Wordfence

GHSA-hq9m-639w-4vp6

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:40 vuln.today

DescriptionCVE.org

The Remove Yellow BGBOX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'rybb_api_settings' page. This makes it possible for unauthenticated attackers to reset the plugin's stored settings by overwriting its configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Settings-reset CSRF in the Remove Yellow BGBOX WordPress plugin (all versions up to and including 1.0) allows unauthenticated remote attackers to overwrite the plugin's stored configuration by tricking a logged-in site administrator into loading a forged request. The vulnerability stems from absent nonce validation on the rybb_api_settings page, confirmed by Wordfence with direct source code references to admin/rybb_api_settings.php and includes/functions.php. No public exploit code or CISA KEV listing has been identified at time of analysis, and the limited integrity impact keeps real-world priority low.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) describes the root cause: the plugin does not issue or validate WordPress nonces on the rybb_api_settings settings page, meaning any cross-origin POST request targeting that endpoint will be accepted by the server if submitted by an authenticated browser session. Wordfence references pinpoint the missing validation at admin/rybb_api_settings.php line 5 and the underlying reset logic at includes/functions.php line 16, present in both the 1.0 tagged release and the current trunk. The affected product is identified by CPE cpe:2.3:a:jay_patel:remove_yellow_bgbox:*:*:*:*:*:*:*:*, covering all releases through 1.0. WordPress nonces are the platform-standard CSRF token mechanism; omitting nonce verification on any state-changing admin endpoint violates WordPress plugin development best practices.

RemediationAI

No vendor-released patched version has been confirmed in the available data; the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b30d27-a3f8-4535-a47f-675c939ec648 and the WordPress plugin repository should be monitored for a fix release. As an immediate compensating control, administrators should deactivate or uninstall the Remove Yellow BGBOX plugin until a patched version is confirmed; deactivation fully eliminates the attack surface but also removes plugin functionality. If the plugin must remain active, restricting access to the wp-admin panel to known IP ranges reduces the social-engineering surface, since the forged request must originate from an authenticated admin session. A WAF rule blocking unanticipated POST requests to the rybb_api_settings endpoint can provide an additional layer, but does not address the underlying nonce validation defect.