LEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery zu Plugin-Einstellungen-Update

The primary impact of this XSRF vulnerability lies in the ability of an attacker to modify the plugin's configuration settings. Successful exploitation could lead to attackers altering email validation rules, potentially allowing spam or malicious emails to bypass filters. This could result in users receiving unwanted or harmful communications, impacting the overall security and reputation of the WordPress site. While the vulnerability requires tricking a site administrator into performing an action (e.g., clicking a malicious link), the potential for widespread impact across multiple users makes it a significant concern. The attacker does not need authentication to exploit the vulnerability, only to craft a request that appears legitimate to the plugin.

WordPress sites utilizing the LEAV Last Email Address Validator plugin, particularly those with site administrators who are susceptible to social engineering attacks, are at risk. Shared hosting environments where multiple websites share the same server resources could also be affected if one site is compromised.

• wordpress / composer / npm:

grep -r 'display_settings_page' /var/www/html/wp-content/plugins/leav-last-email-address-validator/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep leav-last-email-address-validator

• wordpress / composer / npm:

wp plugin update --all

1. 2026-01-16Disclosure

   disclosure

1. Reserviert2025-12-17
2. Veröffentlicht2026-01-16
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The most effective mitigation is to upgrade to a patched version of the LEAV Last Email Address Validator plugin as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. These include restricting access to the plugin's settings page to authenticated administrators only, and implementing stricter input validation on all parameters passed to the displaysettingspage function. Web Application Firewalls (WAFs) can be configured to detect and block suspicious requests targeting this endpoint. Monitor WordPress logs for unusual activity related to the plugin's settings.