What is the CVSS score of CVE-2026-8906?

CVE-2026-8906 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP Promoter CVE-2026-8906

EUVD-2026-32116 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-27 security@wordfence.com

GHSA-rg3q-ffcx-mq26

WordPress CSRF

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:39 vuln.today

CVE Published

May 27, 2026 - 08:16 nvd

MEDIUM 6.1

DescriptionCVE.org

The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in WP Promoter (WordPress plugin, all versions ≤1.3) enables unauthenticated remote attackers to update plugin settings and inject persistent malicious JavaScript by tricking an authenticated administrator into clicking a crafted link. The CVSS changed-scope designation (S:C) signals that successfully injected scripts execute in the browsers of subsequent site visitors - extending impact beyond the targeted administrator. No public exploit code has been identified and EPSS at 0.01% (2nd percentile) reflects negligible observed exploitation activity at time of analysis.

Technical ContextAI

WP Promoter is a WordPress plugin whose administrative settings are handled by functions in admin-wp-promoter.php. WordPress relies on nonces - one-time cryptographic tokens embedded in forms and AJAX requests - to verify that state-changing requests originate from legitimate, in-context user actions. The vulnerability (CWE-352) arises from missing or incorrect nonce validation in at least four handler functions, visible at lines 45, 64, 66, and 120 of the version 1.3 source in the WordPress plugin SVN repository. Because these functions also process and persist user-supplied input without adequate sanitization, a successful CSRF request can introduce stored XSS payloads. The S:C (Changed Scope) in the CVSS vector reflects this secondary impact: the injected script operates in the security context of site visitors' browsers, not solely the admin session that was exploited.

RemediationAI

No vendor-released patched version is identified in the available data; all supplied references point to the version 1.3 source tree with no newer release tag confirmed. Until a patched version is published, the most reliable remediation is to deactivate and remove the WP Promoter plugin entirely - this eliminates exposure with no residual risk, at the cost of losing the plugin's promotional functionality. If the plugin must remain active, restrict WordPress admin dashboard access to known IP ranges at the web server or WAF layer, which reduces the population of administrators who can be socially engineered. Deploying Wordfence or an equivalent WAF with CSRF and XSS rule sets provides additional detection and blocking capability, though this is defense-in-depth rather than a definitive fix. Administrators should monitor the Wordfence advisory at wordfence.com/threat-intel/vulnerabilities/id/8451fe09-4280-49ef-b088-698cbf40b86b and the WordPress plugin repository for an updated release.