CVE-2026-32344: CSRF in Corpiva WordPress Plugin

The primary impact of this CSRF vulnerability lies in the potential for unauthorized actions within the Corpiva plugin. An attacker could craft malicious links or embed them in websites or emails, enticing authenticated users of the plugin to click them. Upon clicking, the attacker could execute actions as the user, such as modifying plugin settings, deleting data, or potentially gaining access to sensitive information managed by the plugin. The blast radius depends on the plugin's functionality and the permissions granted to affected users. If the plugin handles critical data or integrates with other systems, the impact could be significant.

1. Reserved2026-03-12
2. Published2026-03-13
3. Modified2026-04-29
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-32344 is to immediately upgrade the Corpiva plugin to version 1.0.97 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing a Web Application Firewall (WAF) with CSRF protection rules. These rules can help detect and block malicious requests. Additionally, carefully review and restrict user permissions within the Corpiva plugin to limit the potential impact of a successful CSRF attack. After upgrading, verify the fix by attempting to trigger a CSRF attack using a known payload and confirming that the action is blocked.

Plugin rating

5.0