Cross-Site Request Forgery in GoStats Plugin for WordPress

CVE-2026-8943

What is CVE-2026-8943?

The GoStats for WordPress plugin is vulnerable to Cross-Site Request Forgery due to inadequate nonce validation within the gostats_manage() function. This flaw allows attackers to exploit the vulnerability without authentication, potentially enabling them to change essential plugin settings (such as gostats_siteid and gostats_server options) by persuading an administrator to execute a malicious request. This risk underlines the importance of robust nonce checks to safeguard against unauthorized actions within the plugin.

References