CVE-2026-32343: CSRF in Easy Table of Contents WordPress Plugin

A successful CSRF attack could allow an attacker to modify the Easy Table of Contents settings, potentially injecting malicious code or altering the plugin's behavior. This could lead to defacement of the website, unauthorized data modification, or even a pathway for further attacks. The impact is amplified if the plugin is used extensively on the site, as a wider range of actions could be exploited. While CSRF typically requires user interaction (e.g., clicking a malicious link), the potential for automated exploitation through social engineering or phishing campaigns exists.

1. Reserved2026-03-12
2. Published2026-03-13
3. Modified2026-04-29
4. EPSS updated2026-03-23

The primary mitigation is to upgrade the Easy Table of Contents plugin to version 2.0.81 or later. If immediate upgrading is not possible due to compatibility issues or testing requirements, consider implementing a Content Security Policy (CSP) to restrict the sources from which the plugin can load resources. Additionally, implement strict input validation and output encoding to prevent malicious data from being processed. Web Application Firewalls (WAFs) configured with CSRF protection rules can also help mitigate the risk, though this is not a substitute for patching the plugin.

Active installs

600KKnown

Plugin rating

4.4

Requires WordPress

5.0+

Compatible up to

7.0

Requires PHP

5.6.20+