EUVD-2026-35306
GHSA-5xqj-g46w-c5mr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to missing or incorrect nonce validation on the handleSaveGeneralSettings function. This makes it possible for unauthenticated attackers to modify the plugin's General Settings and inject arbitrary web scripts into the administrator's browser via the unescaped app_name attribute reflection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected script executes even when the supplied app_name value fails validation and is not persisted to the database, because the form is re-rendered with the attacker-supplied in-memory value on validation failure.
AnalysisAI
Cross-Site Request Forgery combined with reflected XSS in the WpMobi WordPress plugin (all versions through 0.0.3) allows unauthenticated attackers to execute arbitrary JavaScript in an administrator's browser session by forging a settings-save request. The handleSaveGeneralSettings function performs no nonce validation, permitting any remote party to submit crafted plugin settings on behalf of an authenticated admin. A particularly notable aspect is that the injected script in the app_name parameter fires even when server-side validation rejects the value, because the view layer re-renders the form with the unsanitized in-memory value rather than a sanitized fallback - meaning the XSS trigger does not depend on successful data persistence. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the WpMobi plugin (CPE: cpe:2.3:a:rahulbhangale:wpmobi:*:*:*:*:*:*:*:*) authored by rahulbhangale for the WordPress ecosystem. The root cause class is CWE-352 (Cross-Site Request Forgery) caused by absent or incorrect WordPress nonce verification in the handleSaveGeneralSettings method located at CWpMobiGeneralSettings.class.php line 37. WordPress nonces are anti-CSRF tokens that bind a form submission to a specific authenticated session; without this check, any page on the internet can submit a POST request to the admin endpoint on behalf of a logged-in administrator. The secondary weakness is unescaped output in the view layer at general_settings.php line 12, where the app_name POST parameter is reflected directly into HTML without encoding. The combination of CSRF (allows unauthorized form submission) and unescaped reflection (allows JavaScript injection) constitutes a stored-XSS-equivalent risk via CSRF delivery. The core registration of the settings handler is visible at CCore.class.php line 61. The attack chain is fully server-side reflected, not stored, but is functionally equivalent in terms of admin-session compromise.
RemediationAI
No vendor-released patch version has been identified in the available data; the affected CPE range covers all versions through 0.0.3 with no upper-bound fix version specified. Site administrators should check the WordPress plugin repository for an updated version of WpMobi beyond 0.0.3 and upgrade immediately if available. If no patched release exists, the most effective compensating control is to deactivate and remove the WpMobi plugin until the vendor releases a fix that adds proper WordPress nonce verification to handleSaveGeneralSettings and output-escapes the app_name value before rendering. As an interim measure, a WAF rule blocking POST requests to the plugin's settings endpoint from unauthenticated or cross-origin referrers can reduce exposure, though this does not eliminate the underlying flaw. Administrators should also review WordPress admin activity logs for unexpected changes to plugin General Settings, particularly the app_name field, as a detection measure. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbd1c5c-d23a-4f89-9225-514552d6ea70?source=cve should be monitored for patch status updates.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today