Stopwords for comments <= 1.1 - Fehlende Autorisierung für Cross-Site Request Forgery

An attacker could exploit this CSRF vulnerability to add or delete stopwords without authentication, effectively bypassing any intended comment filtering mechanisms. This could lead to an influx of unwanted comments, spam, or malicious content. The impact is amplified if the site administrator is tricked into clicking a malicious link, automatically executing the forged request. While the vulnerability doesn't directly lead to data exfiltration or system compromise, it can degrade the user experience and potentially be a stepping stone for further attacks if the stopwords influence other site behaviors.

WordPress sites utilizing the Stopwords for comments plugin, particularly those with shared hosting environments where plugin updates may be delayed, are at risk. Sites with less stringent administrator access controls are also more vulnerable to exploitation.

• wordpress / composer / npm:

grep -r 'set_stopwords_for_comments' /var/www/html/wp-content/plugins/stopwords-for-comments/

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=set_stopwords_for_comments | grep -i '200 ok'

1. 2026-01-14Disclosure

   disclosure

1. Reserviert2025-12-30
2. Veröffentlicht2026-01-14
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade to a patched version of the Stopwords for comments plugin once available. Until a patch is released, consider implementing a Web Application Firewall (WAF) rule to filter requests to the 'setstopwordsforcomments' and 'deletestopwordsforcomments' endpoints, requiring valid CSRF tokens. Additionally, restrict access to the plugin's configuration pages to authorized administrators only. Regularly review WordPress plugin configurations for potential vulnerabilities.