CVE-2026-3772 - Vulnerability Analysis

Overview

WP Editor plugin for WordPress <= 1.2.9.2 contains a cross-site request forgery caused by missing nonce verification in 'add_plugins_page' and 'add_themes_page' functions, letting unauthenticated attackers overwrite plugin and theme PHP files via forged requests, exploit requires site administrator interaction.

Severity & Score

Impact

Attackers can overwrite plugin and theme PHP files with malicious code, leading to remote code execution and full site compromise.

Mitigation

Update to the latest version beyond 1.2.9.2.

References

• https://plugins.trac.wordpress.org/changeset/3480577/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=cve
• https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorPlugins.php#L60
• https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorThemes.php#L103

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner