What is the CVSS score of CVE-2026-8939?

CVE-2026-8939 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Search Simple Fields CVE-2026-8939

EUVD-2026-32059 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-27 security@wordfence.com

GHSA-3jqv-9jvm-w5m3

PHP WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:22 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Search Simple Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the search_simple_fields_options() function in functions_admin.php. This makes it possible for unauthenticated attackers to modify the plugin's settings - including post types to search in, custom fields, media fields and the custom media function name - via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Search Simple Fields WordPress plugin (versions ≤ 0.2) enables unauthenticated remote attackers to modify plugin configuration by tricking an authenticated site administrator into clicking a crafted link. The root cause is absent or incorrect nonce validation in the search_simple_fields_options() function within functions_admin.php, allowing forged HTTP requests to alter settings such as post types, custom fields, media fields, and the custom media function name. No active exploitation is confirmed (no CISA KEV listing, EPSS at 0.01%, SSVC exploitation status: none), making this a low-urgency but straightforward finding on affected WordPress installations.

Technical ContextAI

WordPress relies on cryptographic nonces - short-lived, action-scoped tokens - to verify that form submissions originate from legitimate admin sessions and not from cross-origin forged requests. The search_simple_fields_options() function in functions_admin.php (lines 16 and 21, per WordPress Trac source at tags/0.2) processes settings updates without validating such a nonce, satisfying the definition of CWE-352 (Cross-Site Request Forgery). Because WordPress admin actions are typically triggered via POST or GET requests to wp-admin/, any page the admin visits in a separate browser tab can silently submit a crafted form to that endpoint. The affected codebase is PHP-based, consistent with the reported tags (PHP, WordPress, CSRF). No CPE strings were provided in the source intelligence; affected scope is defined as Search Simple Fields versions 0 through 0.2 inclusive per ENISA EUVD-2026-32059.

RemediationAI

No vendor-released patch identified at time of analysis - the available references point only to the vulnerable 0.2 source code on WordPress Trac, and no fixed version number is confirmed in the provided intelligence. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1d7ffc0b-2706-4707-9b8f-edcb418058ca?source=cve for a patched release. As an immediate compensating control, deactivating or uninstalling the Search Simple Fields plugin eliminates the attack surface entirely with the trade-off that any search functionality it provides will be unavailable. If the plugin functionality is required, restricting wp-admin access to trusted IP ranges (via server-level rules or a WAF) reduces the exploitability of CSRF attacks against admin endpoints, though it does not fix the underlying flaw. Administrators should also be vigilant against phishing attempts targeting WordPress admin accounts, as UI:R exploitation depends entirely on social engineering a logged-in admin.