What is the CVSS score of EUVD-2026-34926?

EUVD-2026-34926 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Frontend User Notes EUVD-2026-34926

| CVE-2026-7047 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-06 security@wordfence.com

GHSA-pjrp-wx6v-7795

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 00:30 vuln.today

CVE Published

Jun 06, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the funp_ajax_modify_notes function. This makes it possible for unauthenticated attackers to trick a logged-in user into visiting a malicious page, causing unauthorized overwriting of that victim's own note content via a forged cross-site request to wp_update_post() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to ownership enforcement comparing the note's stored _funp_single_user_id meta against the current session's user ID, the attack is limited to modifying only notes belonging to the tricked victim, and cannot be used to alter notes owned by arbitrary third-party users.

AnalysisAI

Cross-Site Request Forgery in the Frontend User Notes WordPress plugin (all versions through 2.1.1) allows unauthenticated remote attackers to trick an authenticated victim into overwriting their own note content. The funp_ajax_modify_notes function lacks proper nonce validation, enabling forged requests to invoke wp_update_post() on behalf of the logged-in victim. No public exploit has been identified at time of analysis, and the attack's impact is bounded by ownership enforcement: only the tricked victim's own notes can be altered, not those of arbitrary third-party users.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) describes state-changing operations that rely solely on session-based authentication without a secondary request-origin token. In WordPress, the standard defense is nonce validation via wp_verify_nonce(). The funp_ajax_modify_notes AJAX handler at includes/ajax.php (lines 108 and 157 in the 2.1.1 tag) bypasses this check, allowing any cross-origin POST request carrying a valid session cookie to invoke wp_update_post(). Ownership is partially enforced through comparison of the _funp_single_user_id post meta against the current session's user ID, which prevents horizontal escalation to other users' notes but does not prevent the CSRF vector itself. The affected plugin is the Frontend User Notes plugin for WordPress, confirmed via Wordfence threat intelligence and the WordPress plugin Trac repository.

RemediationAI

An upstream fix has been committed to the plugin's trunk repository via changeset 3559955 (https://plugins.trac.wordpress.org/changeset/3559955/), which addresses the missing nonce validation in funp_ajax_modify_notes. However, an exact released and tagged patched version number is not independently confirmed from the available input data - administrators should verify the current version in the WordPress Plugin Directory and update if a version beyond 2.1.1 is available. As a compensating control prior to patching, administrators can deactivate the Frontend User Notes plugin to eliminate the attack surface entirely; the trade-off is loss of the plugin's note-taking functionality for frontend users. Restricting AJAX endpoints via a Web Application Firewall to block cross-origin POST requests to wp-admin/admin-ajax.php targeting the funp_ajax_modify_notes action is a secondary mitigation, though this may affect legitimate plugin functionality and requires careful WAF rule tuning.