What is the CVSS score of EUVD-2026-26497?

EUVD-2026-26497 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WP Editor are affected by EUVD-2026-26497?

CVE-2026-3772 is a high-severity cross-site request forgery vulnerability in WP Editor plugin (versions ≤1.2.9.2) that allows unauthenticated attackers to inject arbitrary PHP code and overwrite…

How to fix or mitigate EUVD-2026-26497?

Within 24 hours: Identify all WordPress installations using WP Editor plugin and document current versions via wp-cli or admin dashboard. Within 7 days: Update WP Editor plugin to version containing changeset 3480577 (verify exact release version with vendor); if unavailable, disable and deactivate the plugin immediately. Within 30 days: Audit all plugin and theme files for unauthorized modifications; review administrative user access logs for suspicious CSRF activity; implement Web Application Firewall rules to block CSRF attacks targeting wp-admin endpoints.

WP Editor EUVD-2026-26497

| CVE-2026-3772 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-01 Wordfence

CSRF PHP WordPress

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 12:00 vuln.today

EUVD ID Assigned

May 01, 2026 - 11:45 euvd

EUVD-2026-26497

Analysis Generated

May 01, 2026 - 11:45 vuln.today

CVE Published

May 01, 2026 - 11:18 nvd

HIGH 8.8

DescriptionCVE.org

The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

AnalysisAI

Cross-Site Request Forgery in WP Editor plugin through version 1.2.9.2 enables remote attackers to inject arbitrary PHP code into plugin and theme files. The vulnerability requires administrator interaction (clicking a malicious link) but no authentication for the attacker, allowing complete website compromise through file overwrite. EPSS data not available; no confirmed active exploitation at time of analysis. Patch available in changeset 3480577.

Technical ContextAI

WP Editor is a WordPress plugin (cpe:2.3:a:benjaminprojas:wp_editor) that provides functionality for editing plugin and theme files through the WordPress admin interface. The vulnerability stems from CWE-352 (Cross-Site Request Forgery) in the WPEditorPlugins.php and WPEditorThemes.php classes. Specifically, the 'add_plugins_page' (line 60) and 'add_themes_page' (line 103) functions process file modification requests without implementing WordPress nonce tokens, which are cryptographic tokens that prevent CSRF attacks. This architectural flaw allows state-changing operations (writing to PHP files) to occur without verifying the request originated from a legitimate admin session. The lack of nonce verification means any HTTP request containing valid-looking parameters will be processed if an authenticated administrator's browser sends it, regardless of the request's actual origin. This vulnerability class is particularly dangerous in content management systems where admin privileges enable direct file system manipulation.

RemediationAI

Update WP Editor plugin to version 1.2.9.3 or later, which implements nonce verification as shown in WordPress plugin repository changeset 3480577 (https://plugins.trac.wordpress.org/changeset/3480577/). The patch adds proper WordPress nonce tokens to the add_plugins_page and add_themes_page functions, preventing unauthorized state changes. If immediate patching is not possible, disable or uninstall the WP Editor plugin until update can be applied - this eliminates attack surface but removes plugin/theme editing functionality from WordPress admin panel (acceptable trade-off for most sites since core WordPress provides built-in file editor). Alternative compensating control: implement Web Application Firewall (WAF) rules to block requests to wp-admin/admin.php with WP Editor-specific parameters from external referrers, though this may cause usability issues for legitimate multi-tab workflows and does not protect against attacks originating from compromised trusted sites. Do NOT rely solely on administrator security awareness training as primary control - even security-conscious users can fall victim to sophisticated social engineering. Verify patch application by inspecting source code at lines referenced in vulnerability report or confirming changeset 3480577 is present in installed version.