Google PageRank Display <= 1.4 - 設定ページ経由での設定更新に対するクロスサイトリクエストフォージェリ

An attacker exploiting this XSRF vulnerability can trick an authenticated administrator into unknowingly submitting a malicious POST request to the plugin's settings page. Because the gpdisplayoption() function lacks proper nonce validation, the attacker can alter plugin settings stored via updateoption(). This could involve changing display preferences, enabling or disabling features, or even modifying other configuration parameters. The impact depends on the plugin's functionality and the sensitivity of the settings being modified. While direct data theft is unlikely, the attacker could disrupt website operations or potentially introduce further vulnerabilities through altered configurations.

1. 予約済み2026-04-14
2. 公開日2026-04-21
3. 更新日2026-04-22
4. EPSS 更新日2026-04-29

The primary mitigation for CVE-2026-6294 is to upgrade the Google PageRank Display plugin to a version that addresses the nonce validation issue. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out suspicious POST requests to the plugin's settings page. Specifically, look for requests lacking a valid nonce. Additionally, restrict access to the plugin's settings page to authorized administrators only. After upgrading, confirm the fix by attempting to submit a crafted XSRF request to the settings page; the request should be rejected.

アクティブインストール数

10

プラグイン評価