What is the CVSS score of CVE-2026-8940?

CVE-2026-8940 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WP Meta Sort Posts CVE-2026-8940

EUVD-2026-35300 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-09 Wordfence

GHSA-pm2w-7q8v-x3g4

CSRF WordPress PHP

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:12 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 4.3

DescriptionCVE.org

The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the top-level included script in msp-options.php. This makes it possible for unauthenticated attackers to change the plugin's msp_loop_file and msp_nav_location settings via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in WP Meta Sort Posts WordPress plugin (all versions ≤ 0.9) allows unauthenticated remote attackers to modify plugin settings by tricking a logged-in administrator into clicking a crafted link, due to missing nonce validation in msp-options.php. The CVSS vector (PR:N, UI:R) confirms the attacker requires no authentication but must social-engineer an administrator, with impact limited to changing the msp_loop_file and msp_nav_location settings. No active exploitation confirmed - this CVE is not listed in CISA KEV, no public exploit code has been identified, and EPSS data was not provided in available intelligence.

Technical ContextAI

The root cause is CWE-352 (Cross-Site Request Forgery), a class of vulnerability where server-side actions are triggered by forged HTTP requests originating from attacker-controlled pages. WordPress mitigates CSRF via nonce tokens embedded in administrative forms and verified server-side; the plugin's msp-options.php script (lines 18, 27, and 30 per Trac source references) and its registration hook in wp-meta-sort-posts.php (line 106) fail to implement this check on the top-level included settings script. Because the WordPress admin cookie is automatically sent by the browser with cross-origin requests, the forged request inherits the administrator's session. The specific settings at risk - msp_loop_file and msp_nav_location - control file inclusion paths and navigation placement for the plugin. The CPE cpe:2.3:a:jasonpitts:wp_meta_sort_posts:*:*:*:*:*:*:*:* covers all versions, authored by vendor 'jasonpitts', running as a PHP plugin in the WordPress ecosystem.

RemediationAI

No vendor-released patch has been identified at time of analysis - the fix version is not confirmed from available intelligence. The most effective immediate compensating control is to deactivate and remove the WP Meta Sort Posts plugin until a patched release is confirmed via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/06efa097-38dc-4499-b163-7a6254b25f72?source=cve. If the plugin functionality is required, restrict wp-admin access to trusted IP ranges using server-level controls (e.g., .htaccess or nginx allow/deny rules), which eliminates the network vector and prevents forged cross-origin requests from reaching the settings endpoint - trade-off is loss of remote admin access. Additionally, enforce strict administrator email hygiene and phishing awareness to reduce social engineering success. A Web Application Firewall with CSRF detection rules (e.g., Wordfence Security plugin's firewall) may provide partial coverage but should not be relied upon as a primary control. Developers with direct plugin access can manually add wp_verify_nonce() checks at lines 18, 27, and 30 of msp-options.php as a temporary hardening measure.