What is the CVSS score of CVE-2026-9723?

CVE-2026-9723 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Google Plus One Bottom CVE-2026-9723

EUVD-2026-33890 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-02 Wordfence

GHSA-fvx7-fjpx-4m28

Google WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 08:51 vuln.today

CVE Published

Jun 02, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The Google Plus One Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.2. This is due to missing or incorrect nonce validation on the googlePlusOneAdmin function. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the plusone-lang, plusone-callback, and plusone-url options stored in the database via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-site request forgery in the Google Plus One Bottom WordPress plugin (all versions ≤ 0.0.2) enables unauthenticated remote attackers to overwrite plugin settings stored in the WordPress database by tricking an authenticated administrator into clicking a crafted link. The root cause is missing nonce validation in the googlePlusOneAdmin function, exposing the plusone-lang, plusone-callback, and plusone-url options to unauthorized modification. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the social-engineering dependency is the primary limiting factor rather than any technical barrier.

Technical ContextAI

CWE-352 (CSRF) arises when a server-side function processes state-changing requests without verifying that the request was intentionally submitted by the authenticated user. WordPress's standard defense is wp_verify_nonce(), which ties a one-time token to a specific action and user session. The googlePlusOneAdmin function in googlePlusOne.php (referenced at lines 34, 64, and 73 in the plugin browser) processes settings updates without this check, meaning any cross-origin POST that satisfies the admin capability check will be honored if the admin is currently logged in. CPE cpe:2.3:a:ddd2500:google_plus_one_bottom:*:*:*:*:*:*:*:* identifies vendor ddd2500 as the upstream author. The three affected options (plusone-lang, plusone-callback, plusone-url) are WordPress database options controlling the Google Plus One widget's language, JavaScript callback, and target URL - the callback option in particular could be abused to point the widget at attacker-controlled JavaScript endpoints.

RemediationAI

No vendor-released patch has been identified at time of analysis - the available CPE and references do not reference a fixed version beyond 0.0.2. The most effective and recommended remediation is to deactivate and fully remove the Google Plus One Bottom plugin from all WordPress installations; because the underlying Google Plus One service was permanently discontinued by Google in 2019, the plugin provides no functional benefit on any modern site and removal eliminates the attack surface entirely with no operational trade-off. If removal is temporarily blocked by a change-control process, restricting access to the WordPress admin panel (wp-admin and wp-login.php) to known trusted IP addresses via web server configuration or a WAF rule will prevent the CSRF forged request from reaching an authenticated admin session. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/43af2d38-72e8-405f-a910-500fb782ded2 for any patch release notifications.