Cross-Site Request Forgery Vulnerability in WP Promoter Plugin by WordPress
CVE-2026-8906

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
WP Promoter
Vendor
CVE Published:
27 May 2026

What is CVE-2026-8906?

The WP Promoter plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation in its functionality. This flaw allows attackers to craft deceptive requests that can manipulate plugin settings or insert harmful scripts if an administrator is tricked into clicking a malicious link. All versions prior to 1.3 are affected, emphasizing the need for plugin updates to mitigate this security risk.

Affected Version(s)

WP Promoter 0 <= 1.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-promoter/ta...
https://plugins.trac.wordpress.org/browser/wp-promoter/ta...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Nur Ibnu Hubab
.