Cross-Site Request Forgery Vulnerability in TextP2P Texting Widget for WordPress

CVE-2026-4133

What is CVE-2026-4133?

The TextP2P Texting Widget plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit Cross-Site Request Forgery (CSRF). This vulnerability arises from insufficient nonce validation within the imTextP2POptionPage() function, which fails to implement necessary security checks for updating plugin settings. Attackers can exploit this flaw to alter critical settings—including chat widget titles, messages, and API credentials—by deceiving a site administrator into initiating a malicious request. This highlights the necessity for implementing robust security measures in WordPress plugins to safeguard against unauthorized access.

References