CSRF Vulnerability in Abilities Bridge Plugin for WordPress
CVE-2026-122003
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-122003?
The Abilities Bridge WordPress plugin prior to version 1.4.2 lacks proper nonce verification during the re-authentication of REST API requests using a logged-in session cookie. This oversight permits malicious actors to exploit the vulnerability by deceiving a logged-in administrator into accessing a specially crafted webpage. As a consequence, attackers can perform unauthorized REST API actions, which may include creating new administrator accounts, thereby enabling them to gain complete control over the WordPress site.
Affected Version(s)
Abilities Bridge 0 < 1.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.