What is the CVSS score of CVE-2026-8943?

CVE-2026-8943 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

GoStats WordPress CVE-2026-8943

EUVD-2026-32068 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-27 security@wordfence.com

GHSA-5fq6-q5qr-w8hv

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:21 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The GoStats for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the gostats_manage() function. This makes it possible for unauthenticated attackers to update the plugin's settings (gostats_siteid and gostats_server options) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the GoStats for WordPress plugin (all versions ≤ 1.4) allows unauthenticated remote attackers to overwrite plugin configuration options - specifically gostats_siteid and gostats_server - by tricking an authenticated administrator into clicking a crafted link. The root cause is missing or incorrect nonce validation in the gostats_manage() function, bypassing WordPress's standard CSRF defense. No active exploitation has been confirmed: the vulnerability is absent from CISA KEV, carries an EPSS score of 0.01% (2nd percentile), and SSVC rates exploitation status as none - indicating negligible real-world exploitation pressure at time of analysis.

Technical ContextAI

The GoStats for WordPress plugin integrates third-party statistics tracking into WordPress sites by storing a site ID and reporting server URL as WordPress options (gostats_siteid and gostats_server). WordPress's standard CSRF mitigation relies on nonce tokens generated via wp_nonce_field() and verified via check_admin_referer() or wp_verify_nonce() before processing any state-changing admin action. The gostats_manage() function, visible in the plugin source at GoStats.php lines 26-27 (plugins.trac.wordpress.org), omits or incorrectly implements this nonce check, making the function callable via a forged cross-origin POST request. CWE-352 (Cross-Site Request Forgery) is the root cause class - the server cannot distinguish a legitimate admin-initiated request from a browser-submitted forgery because no per-session secret is validated. All plugin versions from initial release through 1.4 inclusive are confirmed affected per ENISA EUVD-2026-32068.

RemediationAI

No exact patched version number is confirmed in the available intelligence data - the affected range is stated only as all versions through 1.4. Site operators should immediately check the WordPress plugin repository for a release newer than 1.4 and upgrade if one exists; if no update is available, the safest compensating control is to deactivate and remove the GoStats for WordPress plugin entirely, which eliminates all CSRF exposure at the cost of disabling site statistics collection. As an interim mitigation, operators using Wordfence or similar WAF solutions should ensure CSRF-blocking rules are active, as these can intercept forged requests targeting admin endpoints. Restricting wp-admin access by IP allowlist reduces the social-engineering attack surface by limiting which sessions an attacker can target. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3efaf738-1ab8-4a22-9536-157c346e9536 should be monitored for patch release announcements.