What is the CVSS score of CVE-2026-8708?

CVE-2026-8708 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Genzel Breadcrumbs CVE-2026-8708

EUVD-2026-32090 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-27 security@wordfence.com

GHSA-wc6r-m6wj-xmch

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:22 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Genzel breadcrumbs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the _options_page function. This makes it possible for unauthenticated attackers to update the plugin's breadcrumb configuration, including templates, delimiter, home label, home URI, and breadcrumb rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Genzel breadcrumbs WordPress plugin (all versions ≤1.2) enables unauthenticated attackers to silently overwrite breadcrumb configuration - including templates, delimiters, home labels, URIs, and routing rules - by tricking a logged-in administrator into loading a forged request. The flaw is rooted in absent nonce validation inside the _options_page function, confirmed at gb.class.php lines 412 and 424 and page-options.php line 16. No public exploit identified at time of analysis; EPSS of 0.01% (2nd percentile) signals negligible mass-exploitation probability.

Technical ContextAI

WordPress relies on cryptographic nonce tokens embedded in admin forms to bind submissions to authenticated sessions and prevent CSRF (CWE-352). The Genzel breadcrumbs plugin's _options_page handler - visible in the WordPress plugin trac at gb.class.php (lines 412, 424) and page-options.php (line 16) - processes breadcrumb configuration POST requests without verifying a nonce, meaning any valid HTTP POST to that endpoint during an active admin session will be accepted as legitimate. The CVSS vector AV:N/AC:L/PR:N/UI:R confirms the attack is network-reachable with no complexity barrier or prior privilege, but mandates that the browser of an authenticated administrator be weaponized as the unwitting HTTP client. No CPE string was provided in source data; the affected product range is confirmed by ENISA EUVD-2026-32090 as Genzel breadcrumbs versions 0 through 1.2 inclusive.

RemediationAI

No vendor-released patched version has been identified in the available data - references point to source code on the WordPress plugin trac and the Wordfence advisory without citing a fixed release. Upstream fix availability cannot be confirmed at time of analysis; the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e4ffa9-9f61-42e8-85f5-1dea499a63f7 should be monitored for patch release updates. As an immediate compensating control, deactivating the Genzel breadcrumbs plugin eliminates the attack surface entirely with the trade-off of losing breadcrumb navigation functionality. Alternatively, sites running the Wordfence WAF plugin can apply firewall rules to block unauthorized POST requests to the plugin's options page endpoint, though this requires active Wordfence Premium or a manually crafted rule. Administrators should also adopt general CSRF hygiene: avoid clicking external links while logged into WordPress admin, use browser session isolation, and enforce short session timeouts.