Cross-Site Request Forgery Vulnerability in User Admin Simplifier Plugin for WordPress

CVE-2026-11775

What is CVE-2026-11775?

The User Admin Simplifier plugin for WordPress suffers from a Cross-Site Request Forgery vulnerability that affects all versions up to and including 3.0.0. This vulnerability arises from inadequate validation of nonces in the useradminsimplifier_options_page function. It allows unauthenticated attackers to craft malicious requests that can reset and delete a user's menu and admin-bar configurations. By tricking a site administrator into performing an action (like clicking a link), attackers could exploit this vulnerability and overwrite the useradminsimplifier_options database entry through the uas_save_admin_options() function. Prompt action is recommended to secure affected installations.

References