What is the CVSS score of CVE-2026-8941?

CVE-2026-8941 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

CDN Linker lite CVE-2026-8941

EUVD-2026-32067 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-27 security@wordfence.com

GHSA-xv87-885h-7wj2

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:18 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The CDN Linker lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the ossdl_off_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings - including the CDN URL used to rewrite all static asset references on the site - via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in CDN Linker lite WordPress plugin (versions up to and including 1.3.1) enables unauthenticated remote attackers to hijack a site's CDN URL by tricking a logged-in administrator into triggering a forged request. The vulnerable function, ossdl_off_options(), lacks proper nonce validation, meaning an attacker who successfully engineers admin interaction can repoint all static asset references - JavaScript, CSS, images - to an attacker-controlled domain. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score of 0.01% (2nd percentile) reflects low current exploitation probability.

Technical ContextAI

CDN Linker lite is a WordPress plugin (slug: ossdl-cdn-off-linker) that rewrites URLs for static assets to serve them from a configured CDN endpoint. The vulnerability resides in the ossdl_off_options() function (wp-cdn-linker.php, approximately lines 39 and 43 per the WordPress trac references), which handles plugin settings updates without validating a WordPress nonce - the standard CSRF token mechanism for admin actions. CWE-352 (Cross-Site Request Forgery) identifies the root cause: the server accepts state-changing requests without confirming the request originated from a trusted, authenticated browser session. Because WordPress admin forms are predictable in structure, forging a valid-looking POST to this function requires no prior knowledge of session tokens, only that an administrator is currently authenticated when the request is submitted.

RemediationAI

No vendor-released patch identified at time of analysis - the available references point exclusively to the vulnerable 1.3.1 tag in the WordPress plugin repository with no newer tagged release visible. Site administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3d5bc7a0-89b8-47fc-a6fa-7eb141d2be31 and the WordPress plugin page for a patched release. As an immediate compensating control, deactivating or removing the CDN Linker lite plugin eliminates the attack surface entirely at the cost of CDN URL rewriting functionality - assets will be served from the origin server. If the plugin must remain active, administrators should apply strict Content Security Policy headers to limit which domains can serve scripts and stylesheets, reducing the blast radius if the CDN URL is tampered with. Additionally, restricting WordPress admin access by IP address or requiring VPN for admin panel access raises the bar for the social engineering prerequisite.