EUVD-2026-20109
GHSA-jpg5-qfwx-chrw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation in the quran_playlist_options() function that handles the plugin's settings page. The function processes POST requests to update plugin options via update_option() without any wp_nonce_field() in the form or wp_verify_nonce()/check_admin_referer() verification before processing. This makes it possible for unauthenticated attackers to modify plugin settings (toggling display options for PDF, RSS, podcast, media player links, playlist title, and playlist code) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery (CSRF) in the Quran Translations WordPress plugin versions up to 1.7 allows unauthenticated attackers to modify plugin settings by tricking site administrators into clicking a malicious link. The vulnerability stems from missing nonce validation in the quran_playlist_options() function, which processes POST requests to update options like PDF, RSS, podcast, and media player display settings without cryptographic request verification. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The Quran Translations plugin (CPE: cpe:2.3:a:edckwt:quran_translations:*:*:*:*:*:*:*:*) implements a settings form handler in the quran_playlist_options() function that directly calls update_option() to persist user-configurable display toggles. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), a foundational web security issue where state-changing operations lack protection against cross-origin request forgery. The plugin fails to implement WordPress's standard CSRF mitigation mechanisms: wp_nonce_field() to embed a token in the HTML form and wp_verify_nonce() or check_admin_referer() to validate the token on POST receipt. This allows any attacker to craft an HTML page containing a hidden form that, when visited by an authenticated administrator, silently submits forged requests to update plugin configuration, bypassing the administrative intent requirement.
RemediationAI
Site administrators should immediately upgrade the Quran Translations plugin to version 1.8 or later, which includes nonce validation fixes. The patch adds wp_nonce_field() to the settings form and implements wp_verify_nonce() or check_admin_referer() verification before processing option updates. To apply the fix, navigate to the WordPress Plugins dashboard, locate 'Quran Translations by EDC', and click 'Update' if available; if an update is not displayed, manually download the latest version from https://plugins.wordpress.org/plugins/quran-translations-by-edc/ and reinstall. As an interim workaround pending an update (if unavailable), site administrators can restrict plugin settings page access to trusted IP ranges via their web server configuration or Web Application Firewall, or disable the plugin until a patched version is released. No vendor-released patch information is confirmed in the provided input; administrators should verify version 1.8+ availability directly with the plugin author or via the WordPress plugin repository.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today