Désactiver les notifications d'administrateur – Masquer les notifications du tableau de bord <= 1.4.2 - Cross-Site Request Forgery vers la mise à jour des paramètres du plugin

An attacker exploiting this XSRF vulnerability could trick a WordPress administrator into unknowingly adding malicious URLs to the plugin's blocked redirects list. This could be achieved through a crafted link or form submission. Once added, these URLs could redirect administrators to phishing sites, inject malicious code, or perform other unauthorized actions on the WordPress site. The potential impact extends beyond simple redirection; an attacker could leverage this to gain control over administrative functions if the redirects are used in sensitive areas of the WordPress dashboard. The blast radius is limited to the WordPress site itself and its administrators.

WordPress sites utilizing the Disable Admin Notices – Hide Dashboard Notifications plugin, particularly those with administrative accounts that are frequently targeted by phishing campaigns, are at risk. Shared hosting environments where multiple WordPress sites share the same server resources are also potentially vulnerable, as a compromise of one site could lead to attacks against others.

• wordpress / composer / npm:

grep -r 'showPageContent()' /var/www/html/wp-content/plugins/disable-admin-notices-hide-dashboard-notifications/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/disable-admin-notices-hide-dashboard-notifications/ | grep -i 'X-Frame-Options'

1. 2026-02-25Disclosure

   disclosure

1. Réservé2026-02-12
2. Publiée2026-02-25
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-2410 is to immediately upgrade the Disable Admin Notices – Hide Dashboard Notifications plugin to version 1.4.3 or later. If upgrading is not immediately feasible, consider temporarily disabling the plugin to prevent further exploitation. As a short-term workaround, implement strict input validation and output encoding on all user-supplied data used in the plugin’s redirect functionality. Regularly review the plugin’s configuration for any suspicious entries in the blocked redirects list. After upgrading, confirm the fix by attempting to trigger a forged request and verifying that it is rejected.

Installations actives

100KNiche

Note du plugin