EUVD-2026-24706
GHSA-8w4w-mfg4-cvw8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Google PageRank Display plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4. This is due to missing nonce validation in the gpdisplay_option() function, which handles the plugin settings page. The settings form does not include a wp_nonce_field(), and the form handler does not call check_admin_referer() or wp_verify_nonce() before processing the POST request. This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a crafted request that changes the plugin's settings (stored via update_option()), such as the display style used to render the PageRank badge.
AnalysisAI
Cross-Site Request Forgery in Google PageRank Display plugin for WordPress (versions up to 1.4) allows unauthenticated attackers to trick logged-in administrators into changing plugin settings via a crafted request, due to missing nonce validation in the settings form handler. The vulnerability has a CVSS score of 4.3 (network-based, low complexity, requires user interaction) and enables modification of plugin configuration such as display style without administrator knowledge.
Technical ContextAI
The Google PageRank Display WordPress plugin stores configuration via WordPress's update_option() function. The gpdisplay_option() function processes POST requests from the plugin's settings page but lacks Cross-Site Request Forgery protection mechanisms. Specifically, the settings form is missing wp_nonce_field() to generate a nonce token, and the form handler does not validate the request using check_admin_referer() or wp_verify_nonce() before processing. This is a violation of WordPress plugin security best practices outlined in the WordPress Plugin Security Handbook. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), a common weakness in web applications that fail to verify the origin of state-changing requests.
RemediationAI
Update the Google PageRank Display plugin to version 1.5 or later to obtain the patched version with nonce validation implemented. Site administrators should immediately update via the WordPress plugin dashboard or by manually downloading the latest version from the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/google-pagerank-display/. As an interim workaround before updating, disable the plugin if it is not critical to site operations, or restrict access to the WordPress admin dashboard to trusted IP addresses using .htaccess or a security plugin to reduce the window for social engineering attacks. However, these workarounds do not eliminate the vulnerability itself and are not substitutes for patching.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today