Cross-Site Request Forgery Vulnerability in Auto Post Scheduler Plugin by WordPress

CVE-2026-1877

What is CVE-2026-1877?

The Auto Post Scheduler plugin for WordPress exhibits a security flaw due to the absence of nonce validation in the 'aps_options_page' function. This vulnerability enables unauthorized individuals to perform Cross-Site Request Forgery attacks. Attackers can exploit this weakness to manipulate settings and inject harmful scripts if they successfully deceive an administrator into triggering a malicious request, such as clicking a compromised link. It's crucial for website administrators to apply security measures to safeguard against these potential exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References