What is the CVSS score of CVE-2026-8425?

CVE-2026-8425 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Notify Odoo WordPress Plugin CVE-2026-8425

EUVD-2026-30520 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-15 Wordfence

GHSA-3f5m-qf4w-pxwc

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 09:32 vuln.today

CVE Published

May 15, 2026 - 07:46 nvd

MEDIUM 4.3

DescriptionCVE.org

The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the _updateSettings function. This makes it possible for unauthenticated attackers to change the Notify Odoo URL to an attacker-controlled URL and modify notification, tracking image, and allowed IP address settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

The Notify Odoo WordPress plugin up to version 1.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the _updateSettings function that allows unauthenticated attackers to modify critical plugin configuration-including the Notify Odoo URL, notification settings, tracking image configuration, and allowed IP addresses-by tricking site administrators into clicking a malicious link. The vulnerability requires user interaction (administrator action) but poses a direct integrity risk by enabling attackers to redirect plugin functionality to attacker-controlled servers or disable legitimate notification and tracking features.

Technical ContextAI

This vulnerability stems from missing or incorrect nonce validation (CWE-352) in the _updateSettings administrative function within the Notify Odoo WordPress plugin. WordPress nonces are cryptographic tokens designed to prevent CSRF attacks by validating that state-changing requests originate from legitimate users within the same session. The affected code (Settings.php line 46) processes admin settings updates without properly verifying the nonce parameter before applying changes. WordPress plugins must explicitly call wp_verify_nonce() on POST/GET parameters containing nonces before executing sensitive operations like settings updates. The absence or misconfiguration of this check allows attackers to craft HTML forms or JavaScript that silently submit requests with a site administrator's existing session credentials, causing unauthorized settings modifications. The plugin's settings page template (line 54 of settings.php) likely fails to output nonces correctly in the form fields, completing the exploitation chain.

RemediationAI

Upgrade the Notify Odoo plugin to a patched version once released by the developer. If no patched version is available at the time of remediation, implement immediate compensating controls: (1) Restrict administrative access to trusted IP addresses via .htaccess or web application firewall rules-this prevents attackers from delivering CSRF payloads to admin sessions from external networks, though it reduces flexibility for remote administration. (2) Disable the Notify Odoo plugin entirely if not actively used, eliminating the attack surface. (3) Educate site administrators to avoid clicking links from untrusted emails or websites while logged into WordPress admin, as this is the required trigger for the attack. (4) Monitor plugin settings changes via WordPress audit logging or plugins like Wordfence or Sucuri to detect unauthorized configuration modifications. Consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ccaba382-7fe8-4197-bec4-87c35d9a7a81?source=cve for the latest patch status and developer communications.