What is the CVSS score of EUVD-2026-32117?

EUVD-2026-32117 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

MetaMagic SEO Plugin EUVD-2026-32117

| CVE-2026-8942 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-27 security@wordfence.com

GHSA-w9w5-x24x-qc8j

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:39 vuln.today

CVE Published

May 27, 2026 - 08:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The MetaMagic SEO Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the metamagic_update_options function. This makes it possible for unauthenticated attackers to modify the plugin's SEO settings, including enabling or disabling the plugin and toggling description and keyword meta tag output via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in MetaMagic SEO Plugin for WordPress (all versions ≤ 1.6) enables unauthenticated remote attackers to modify plugin SEO configuration - including enabling or disabling the plugin and toggling meta tag output - by inducing a logged-in administrator to trigger a forged HTTP request. The root cause is missing or incorrect nonce validation in the metamagic_update_options function, as confirmed by Wordfence (security@wordfence.com) and indexed under ENISA EUVD-2026-32117. No public exploit identified at time of analysis; EPSS at 0.01% (2nd percentile) and SSVC exploitation status of 'none' indicate very low real-world exploitation probability at this time.

Technical ContextAI

The vulnerability exists within the metamagic_update_options function in metamagic.php (lines 143 and 188 per WordPress trac source), which handles administrative configuration updates for the MetaMagic SEO Plugin. WordPress plugins are expected to validate nonces - cryptographic tokens tied to a user session - on every state-changing request to prevent cross-origin forgeries. CWE-352 (Cross-Site Request Forgery) identifies the root cause class: the server fails to verify that an incoming state-changing request was intentionally initiated by the authenticated user rather than forged by a third-party page. The affected plugin manages SEO metadata (description and keyword meta tags) for WordPress sites, making this an integrity-only risk to on-page SEO configuration. No CPE string was provided in the input data; affected scope is confirmed as all MetaMagic SEO Plugin versions from 0 through 1.6 inclusive.

RemediationAI

No vendor-released patch version is confirmed in the available data - the references link to WordPress trac source code and the Wordfence advisory without specifying a fixed release version. Administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a08e4147-9a57-4936-9a18-02110c79a8bb for a patched release beyond 1.6. As an immediate compensating control, deactivating the MetaMagic SEO Plugin via the WordPress admin dashboard eliminates the attack surface entirely, with the trade-off of losing SEO metadata functionality until a patch is available. Alternatively, a WAF rule blocking forged requests to the metamagic_update_options endpoint (e.g., via Wordfence's own WAF or a similar plugin-level firewall) can mitigate the CSRF vector while preserving functionality. Upstream fix availability should be confirmed via the WordPress plugin changelog before re-enabling the plugin.