Cross-Site Request Forgery in WP Editor Plugin for WordPress

CVE-2026-3772

What is CVE-2026-3772?

The WP Editor plugin for WordPress is susceptible to a Cross-Site Request Forgery due to a lack of nonce verification in critical functions like 'add_plugins_page' and 'add_themes_page'. This vulnerability allows unauthorized attackers to manipulate plugin and theme PHP files if they deceive a site administrator into executing a malicious action, such as clicking a link. To mitigate this threat, it is essential for users to update to a newer version that addresses this flaw.

References