What is the CVSS score of CVE-2026-9722?

CVE-2026-9722 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Laiser Tag CVE-2026-9722

EUVD-2026-33899 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-02 Wordfence

GHSA-rh8x-77pm-8pvm

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 08:51 vuln.today

CVE Published

Jun 02, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the addOptionsPageFields function. This makes it possible for unauthenticated attackers to update the plugin's settings, including the API key, tag blacklist, relevance threshold, batch size, and tagging toggles, via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Laiser Tag WordPress plugin (versions up to and including 1.2.5) allows unauthenticated remote attackers to overwrite critical plugin settings - including API keys, tag blacklists, relevance thresholds, batch sizes, and tagging toggles - by tricking a logged-in site administrator into clicking a crafted link. The root cause is missing or incorrect nonce validation on the addOptionsPageFields function, as identified by Wordfence and corroborated by source references pointing to Tagging.php and adminOptionPage.php in the plugin's trunk. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world exploitation opportunity relatively constrained by the required administrator interaction.

Technical ContextAI

The Laiser Tag plugin (vendor: pcis, CPE: cpe:2.3:a:pcis:laiser_tag:*:*:*:*:*:*:*:*) is a WordPress tagging automation plugin that exposes an admin options page. CWE-352 (Cross-Site Request Forgery) arises when state-changing server actions lack origin verification - in WordPress this is typically implemented via wp_verify_nonce() checks. The vulnerable function, addOptionsPageFields, registered to handle the plugin's admin settings form (referenced in Tagging.php at lines L200 and L212, and the admin template at adminOptionPage.php L91), performs no such nonce check. This allows any external site to host a form or script that submits a forged POST request to the WordPress admin endpoint on behalf of an authenticated administrator, since the browser will automatically attach the victim's session cookies. The affected settings include the third-party API key, meaning an attacker who successfully exploits this could redirect or disable the tagging service entirely.

RemediationAI

No vendor-released patched version is independently confirmed from the available data - the references provided point to the vulnerable source code in the plugin trunk rather than a tagged fixed release. Site administrators should check the WordPress plugin repository for an updated version of Laiser Tag beyond 1.2.5 and upgrade immediately if available. If no patched version is yet published, the most effective compensating control is to deactivate and remove the Laiser Tag plugin until a fix is released, eliminating the attack surface entirely. If removal is operationally impractical, administrators should apply WordPress-level mitigations: restrict admin account email addresses to reduce phishing effectiveness, enable multi-factor authentication on all WordPress administrator accounts (reducing the value of session-based CSRF), and consider a Web Application Firewall rule that blocks cross-origin POST requests to wp-admin endpoints. Note that WAF rules carry a trade-off: overly broad origin restrictions can break legitimate third-party WordPress integrations. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ed3aaa2a-8211-409c-8a75-1ac59e1d55e2 should be monitored for patch confirmation.