Cross-Site Request Forgery Vulnerability in Taqnix Plugin for WordPress

CVE-2026-3565

What is CVE-2026-3565?

The Taqnix plugin for WordPress is prone to a Cross-Site Request Forgery vulnerability affecting all versions up to and including 1.0.3. The lack of proper nonce verification in the taqnix_delete_my_account() function enables attackers to forge requests that can lead to unintentional account deletions by logged-in users. Specifically, the check_ajax_referer() call has been commented out, creating an opportunity for attackers to trick users into executing destructive actions through deceptive links or malicious web pages.

References