What is the CVSS score of CVE-2026-8902?

CVE-2026-8902 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

AJAX Report Comments CVE-2026-8902

EUVD-2026-35308 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-09 Wordfence

GHSA-rxj9-493c-qxmg

WordPress CSRF Wordpress Plugin Ajax Report Comments

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:14 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 4.3

DescriptionCVE.org

The AJAX Report Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation on the rc_options_page function. This makes it possible for unauthenticated attackers to modify plugin settings including link text and markup, success/failure/already-reported messages, comment threshold, cookie duration, reporter-comment toggle, and notification email address, subject, and message body via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the AJAX Report Comments WordPress plugin (≤2.0.4) allows unauthenticated attackers to modify plugin settings by tricking a logged-in administrator into triggering a forged request. The rc_options_page function in report-comments.php performs missing or incorrect nonce validation, enabling an attacker to overwrite notification email addresses, comment thresholds, link text, and message bodies without any privileges of their own. No public exploit code or CISA KEV listing has been identified at time of analysis, but the notification email hijack vector makes this a meaningful integrity risk on affected sites.

Technical ContextAI

WordPress nonce tokens are the platform's primary CSRF defense - each state-changing admin form action is expected to embed a unique, time-limited nonce that the server validates before processing. The rc_options_page function (report-comments.php, approximately line 242 per plugin source reference) either omits this check or performs it incorrectly, meaning any HTTP POST that matches the expected form parameters will be processed regardless of origin. CWE-352 (Cross-Site Request Forgery) directly describes this root cause: the server cannot distinguish legitimate admin-initiated requests from attacker-forged ones submitted by the victim's browser. The affected software is identified by CPE cpe:2.3:a:tierrainnovation:ajax_report_comments:*:*:*:*:*:*:*:*, covering all versions through 2.0.4 of the Tierra Innovation plugin.

RemediationAI

No vendor-released patched version is confirmed at time of analysis - the Wordfence advisory and plugin source references do not specify a fixed release above 2.0.4. Administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7db39101-f16d-4a4b-8165-437af63d55e7 for an updated version that adds proper wp_verify_nonce() calls to rc_options_page. As an immediate compensating control, deactivate or delete the plugin until a patch is available; this eliminates the attack surface entirely with the trade-off of losing comment-reporting functionality. If deactivation is not feasible, restrict WordPress admin access to known trusted users and implement outbound email monitoring to detect unexpected changes to the plugin's notification recipient address. Reducing the number of active administrator accounts directly reduces the pool of social-engineering targets.