What is the CVSS score of CVE-2026-9599?

CVE-2026-9599 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Tectite Forms CVE-2026-9599

EUVD-2026-33894 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-02 Wordfence

GHSA-vcp4-2g2f-9cqj

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 08:49 vuln.today

CVE Published

Jun 02, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The Tectite Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the admin_init function. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the tectite_forms_button option, via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Tectite Forms WordPress plugin (all versions through 1.3) allows unauthenticated remote attackers to modify plugin settings by inducing an authenticated administrator to click a crafted link. The vulnerable surface is the admin_init function, which lacks proper nonce validation (CWE-352), permitting forged requests to alter options such as tectite_forms_button. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The Tectite Forms plugin (CPE: cpe:2.3:a:russellr:tectite_forms:*:*:*:*:*:*:*:*) is a WordPress form-building plugin authored by russellr. The root cause (CWE-352: Cross-Site Request Forgery) lies in the plugin's admin_init action hook handler, where WordPress nonce validation is absent or improperly implemented. WordPress nonces are short-lived tokens embedded in admin forms and URLs to bind state-changing requests to a specific authenticated session; without them, any external site can submit a valid-looking POST or GET request that the WordPress admin backend will honor if the target user is logged in. The affected code paths are visible in the plugin source at class-tectite-forms.php (lines 55-56) and views/admin.php (line 49), all within the 1.3 tag on the official WordPress plugin repository. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N confirms network delivery, low complexity, no attacker privileges required, mandatory user interaction, and limited integrity impact with no confidentiality or availability consequence.

RemediationAI

No vendor-released patched version has been identified at time of analysis based on available intelligence. Site administrators running Tectite Forms 1.3 or earlier should monitor the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/tectite-forms/) for an updated release that includes proper nonce validation on the admin_init function. As a compensating control, administrators should avoid clicking links in unsolicited emails, messages, or third-party pages while logged into the WordPress dashboard - this directly neutralizes the UI:R requirement that this attack chain depends on. Additionally, restricting access to the WordPress admin panel to known IP ranges via server-level rules (e.g., .htaccess or firewall policy) reduces the attacker's ability to deliver a successful forged request. If the plugin is not actively in use, deactivating and removing it eliminates exposure entirely with no functional trade-off.