CVE-2026-2410: XSRF in Disable Admin Notices – Hide Dashboard Notifications

An attacker exploiting this XSRF vulnerability could trick a WordPress administrator into unknowingly adding malicious URLs to the plugin's blocked redirects list. This could be achieved through a crafted link or form submission. Once added, these URLs could redirect administrators to phishing sites, inject malicious code, or perform other unauthorized actions on the WordPress site. The potential impact extends beyond simple redirection; an attacker could leverage this to gain control over administrative functions if the redirects are used in sensitive areas of the WordPress dashboard. The blast radius is limited to the WordPress site itself and its administrators.

1. Reserved2026-02-12
2. Published2026-02-25
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-2410 is to immediately upgrade the Disable Admin Notices – Hide Dashboard Notifications plugin to version 1.4.3 or later. If upgrading is not immediately feasible, consider temporarily disabling the plugin to prevent further exploitation. As a short-term workaround, implement strict input validation and output encoding on all user-supplied data used in the plugin’s redirect functionality. Regularly review the plugin’s configuration for any suspicious entries in the blocked redirects list. After upgrading, confirm the fix by attempting to trigger a forged request and verifying that it is rejected.

Active installs

100KNiche

Plugin rating