What is the CVSS score of EUVD-2026-24706?

EUVD-2026-24706 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Google PageRank Display EUVD-2026-24706

| CVE-2026-6294 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-22 Wordfence

GHSA-8w4w-mfg4-cvw8

CSRF WordPress Google

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:03 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24706

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.3

DescriptionCVE.org

The Google PageRank Display plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4. This is due to missing nonce validation in the gpdisplay_option() function, which handles the plugin settings page. The settings form does not include a wp_nonce_field(), and the form handler does not call check_admin_referer() or wp_verify_nonce() before processing the POST request. This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a crafted request that changes the plugin's settings (stored via update_option()), such as the display style used to render the PageRank badge.

AnalysisAI

Cross-Site Request Forgery in Google PageRank Display plugin for WordPress (versions up to 1.4) allows unauthenticated attackers to trick logged-in administrators into changing plugin settings via a crafted request, due to missing nonce validation in the settings form handler. The vulnerability has a CVSS score of 4.3 (network-based, low complexity, requires user interaction) and enables modification of plugin configuration such as display style without administrator knowledge.

Technical ContextAI

The Google PageRank Display WordPress plugin stores configuration via WordPress's update_option() function. The gpdisplay_option() function processes POST requests from the plugin's settings page but lacks Cross-Site Request Forgery protection mechanisms. Specifically, the settings form is missing wp_nonce_field() to generate a nonce token, and the form handler does not validate the request using check_admin_referer() or wp_verify_nonce() before processing. This is a violation of WordPress plugin security best practices outlined in the WordPress Plugin Security Handbook. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), a common weakness in web applications that fail to verify the origin of state-changing requests.

RemediationAI

Update the Google PageRank Display plugin to version 1.5 or later to obtain the patched version with nonce validation implemented. Site administrators should immediately update via the WordPress plugin dashboard or by manually downloading the latest version from the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/google-pagerank-display/. As an interim workaround before updating, disable the plugin if it is not critical to site operations, or restrict access to the WordPress admin dashboard to trusted IP addresses using .htaccess or a security plugin to reduce the window for social engineering attacks. However, these workarounds do not eliminate the vulnerability itself and are not substitutes for patching.