CVE-2026-6294: XSRF in Google PageRank Display WordPress Plugin

An attacker exploiting this XSRF vulnerability can trick an authenticated administrator into unknowingly submitting a malicious POST request to the plugin's settings page. Because the gpdisplayoption() function lacks proper nonce validation, the attacker can alter plugin settings stored via updateoption(). This could involve changing display preferences, enabling or disabling features, or even modifying other configuration parameters. The impact depends on the plugin's functionality and the sensitivity of the settings being modified. While direct data theft is unlikely, the attacker could disrupt website operations or potentially introduce further vulnerabilities through altered configurations.

1. Reserved2026-04-14
2. Published2026-04-21
3. Modified2026-04-22
4. EPSS updated2026-04-29

The primary mitigation for CVE-2026-6294 is to upgrade the Google PageRank Display plugin to a version that addresses the nonce validation issue. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out suspicious POST requests to the plugin's settings page. Specifically, look for requests lacking a valid nonce. Additionally, restrict access to the plugin's settings page to authorized administrators only. After upgrading, confirm the fix by attempting to submit a crafted XSRF request to the settings page; the request should be rejected.

Active installs

10

Plugin rating