Cross-Site Request Forgery Vulnerability in Auto Post Scheduler Plugin by WordPress
CVE-2026-1877

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Auto Post Scheduler
Vendor
CVE Published:
31 March 2026

What is CVE-2026-1877?

The Auto Post Scheduler plugin for WordPress exhibits a security flaw due to the absence of nonce validation in the 'aps_options_page' function. This vulnerability enables unauthorized individuals to perform Cross-Site Request Forgery attacks. Attackers can exploit this weakness to manipulate settings and inject harmful scripts if they successfully deceive an administrator into triggering a malicious request, such as clicking a compromised link. It's crucial for website administrators to apply security measures to safeguard against these potential exploits.

Affected Version(s)

Auto Post Scheduler 0 <= 1.84

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/auto-post-sche...
https://plugins.trac.wordpress.org/browser/auto-post-sche...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Osvaldo Noe Gonzalez Del Rio
.