EUVD-2026-32117
GHSA-w9w5-x24x-qc8j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The MetaMagic SEO Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the metamagic_update_options function. This makes it possible for unauthenticated attackers to modify the plugin's SEO settings, including enabling or disabling the plugin and toggling description and keyword meta tag output via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in MetaMagic SEO Plugin for WordPress (all versions ≤ 1.6) enables unauthenticated remote attackers to modify plugin SEO configuration - including enabling or disabling the plugin and toggling meta tag output - by inducing a logged-in administrator to trigger a forged HTTP request. The root cause is missing or incorrect nonce validation in the metamagic_update_options function, as confirmed by Wordfence (security@wordfence.com) and indexed under ENISA EUVD-2026-32117. No public exploit identified at time of analysis; EPSS at 0.01% (2nd percentile) and SSVC exploitation status of 'none' indicate very low real-world exploitation probability at this time.
Technical ContextAI
The vulnerability exists within the metamagic_update_options function in metamagic.php (lines 143 and 188 per WordPress trac source), which handles administrative configuration updates for the MetaMagic SEO Plugin. WordPress plugins are expected to validate nonces - cryptographic tokens tied to a user session - on every state-changing request to prevent cross-origin forgeries. CWE-352 (Cross-Site Request Forgery) identifies the root cause class: the server fails to verify that an incoming state-changing request was intentionally initiated by the authenticated user rather than forged by a third-party page. The affected plugin manages SEO metadata (description and keyword meta tags) for WordPress sites, making this an integrity-only risk to on-page SEO configuration. No CPE string was provided in the input data; affected scope is confirmed as all MetaMagic SEO Plugin versions from 0 through 1.6 inclusive.
RemediationAI
No vendor-released patch version is confirmed in the available data - the references link to WordPress trac source code and the Wordfence advisory without specifying a fixed release version. Administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a08e4147-9a57-4936-9a18-02110c79a8bb for a patched release beyond 1.6. As an immediate compensating control, deactivating the MetaMagic SEO Plugin via the WordPress admin dashboard eliminates the attack surface entirely, with the trade-off of losing SEO metadata functionality until a patch is available. Alternatively, a WAF rule blocking forged requests to the metamagic_update_options endpoint (e.g., via Wordfence's own WAF or a similar plugin-level firewall) can mitigate the CSRF vector while preserving functionality. Upstream fix availability should be confirmed via the WordPress plugin changelog before re-enabling the plugin.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today