CVE-2026-74005 in Series Plugin
Summary
by MITRE • 09/17/2026
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified as an unauthenticated Cross-Site Request Forgery within the PublishPress series of WordPress plugins, specifically affecting versions up to and including 3.1.3, represents a critical security flaw that undermines the integrity of administrative actions through web-based manipulation. This class of attack exploits the inherent trust that many web applications place in requests received from an authenticated user's browser without adequately verifying whether those requests were intentionally initiated by the user. In this specific context, the lack of proper anti-CSRF tokens or validation mechanisms allows attackers to craft malicious HTTP requests that mimic legitimate administrative operations performed through the PublishPress plugin interface.
From a technical perspective, the core flaw lies in the absence of state-changing request verification for sensitive endpoints exposed by the affected plugins. When an administrator with valid credentials visits a webpage controlled by an attacker, the browser automatically includes any relevant cookies and authentication headers associated with the target WordPress site. The vulnerable application processes these requests as if they were legitimate actions taken by the authenticated user, such as modifying plugin settings, creating new users, or altering content structures defined within the PublishPress ecosystem. Because the vulnerability is unauthenticated in terms of attack initiation, it does not require prior access to the victim's session for the attacker to trigger the malicious request; however, exploitation typically requires a privileged user with administrative rights on the target WordPress installation to visit the crafted page, thereby leveraging their existing privileges to execute unauthorized changes.
The operational impact of this vulnerability is significant and multifaceted. An attacker can potentially take full control over the compromised website by manipulating plugin configurations that affect site functionality, security settings, or content management workflows. This could lead to defacement, data exfiltration if combined with other vulnerabilities like SQL injection, or the installation of persistent backdoors through malicious plugin updates or code injections facilitated by altered administrative states. Furthermore, because CSRF attacks can be triggered via simple HTML images or scripts embedded in emails or social media posts, the attack surface is broad and difficult for users to detect without specialized security tools. The integrity of the website's data and configuration becomes compromised, potentially leading to service disruption or reputational damage as malicious content is published under the guise of legitimate administrative activity.
This vulnerability aligns with CWE-352, which defines Cross-Site Request Forgery as a flaw where an application does not verify whether requests are intended by the user. It also maps directly to MITRE ATT&CK technique T1076, known as Remote Command Execution through Web Applications, specifically when the CSRF leads to arbitrary code execution or configuration changes that allow further exploitation. Additionally, it relates to CWE-942 for Permissive Cross-domain Referrer Validation if the vulnerability involves bypassing referrer checks, though the primary issue remains the lack of request origin verification and token validation.
To mitigate this risk, immediate action is required by upgrading the PublishPress plugins to version 3.1.4 or later, where these security flaws have been addressed with proper implementation of anti-CSRF tokens for all state-changing operations. Site administrators should also ensure that their WordPress installations are fully updated and employ web application firewalls that can detect and block anomalous request patterns indicative of CSRF attacks. Implementing strict Content Security Policy headers can further restrict the ability of external sites to submit forms or make requests on behalf of authenticated users, adding an additional layer of defense against this type of browser-based attack vector. Regular security audits and penetration testing should be conducted to identify similar vulnerabilities in other plugins that may lack robust request validation mechanisms.