禁用管理通知 – 隐藏仪表盘通知 <= 1.4.2 - 对插件设置更新的跨站请求伪造

An attacker exploiting this XSRF vulnerability could trick a WordPress administrator into unknowingly adding malicious URLs to the plugin's blocked redirects list. This could be achieved through a crafted link or form submission. Once added, these URLs could redirect administrators to phishing sites, inject malicious code, or perform other unauthorized actions on the WordPress site. The potential impact extends beyond simple redirection; an attacker could leverage this to gain control over administrative functions if the redirects are used in sensitive areas of the WordPress dashboard. The blast radius is limited to the WordPress site itself and its administrators.

WordPress sites utilizing the Disable Admin Notices – Hide Dashboard Notifications plugin, particularly those with administrative accounts that are frequently targeted by phishing campaigns, are at risk. Shared hosting environments where multiple WordPress sites share the same server resources are also potentially vulnerable, as a compromise of one site could lead to attacks against others.

• wordpress / composer / npm:

grep -r 'showPageContent()' /var/www/html/wp-content/plugins/disable-admin-notices-hide-dashboard-notifications/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/disable-admin-notices-hide-dashboard-notifications/ | grep -i 'X-Frame-Options'

1. 2026-02-25Disclosure

   disclosure

1. 已保留2026-02-12
2. 发布日期2026-02-25
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-2410 is to immediately upgrade the Disable Admin Notices – Hide Dashboard Notifications plugin to version 1.4.3 or later. If upgrading is not immediately feasible, consider temporarily disabling the plugin to prevent further exploitation. As a short-term workaround, implement strict input validation and output encoding on all user-supplied data used in the plugin’s redirect functionality. Regularly review the plugin’s configuration for any suspicious entries in the blocked redirects list. After upgrading, confirm the fix by attempting to trigger a forged request and verifying that it is rejected.

活跃安装数

100K小众

插件评分