CVE-2026-8422
The Remove meta boxes per user role plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1
CVSS
4.3
Medium
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Published: Jun 2, 2026 · Last modified: Jul 22, 2026 · CWE-352
0.1%EPSS · 30 days0.1%
2026-06-302026-07-23
The Remove meta boxes per user role plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.01. This is due to missing or incorrect nonce validation on the 'remove-meta-boxes-per-user-role' page. This makes it possible for unauthenticated attackers to modify or reset the plugin's per-role meta box visibility settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/remove-meta-boxes-per-user-role/tags/1.01/admin_pages/settings.php#L23
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/remove-meta-boxes-per-user-role/tags/1.01/admin_pages/settings.php#L26
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/remove-meta-boxes-per-user-role/tags/1.01/remove-meta-boxes-per-role.php#L52
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/remove-meta-boxes-per-user-role/trunk/admin_pages/settings.php#L23
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/remove-meta-boxes-per-user-role/trunk/admin_pages/settings.php#L26
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/remove-meta-boxes-per-user-role/trunk/remove-meta-boxes-per-role.php#L52
- www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/e456b08d-ccb9-40b8-9c36-d4b2f7f7fb91?source=cve
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-152128.8 HIG—
——0The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.16hCVE-2026-655407.1 HIG—
——0Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.2dCVE-2026-655397.1 HIG—
——0Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.2dCVE-2026-655366.5 MED—
——0Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.2dCVE-2026-655125.4 MED—
——0Unauthenticated Cross Site Request Forgery (CSRF) in WP Activity Log <= 5.6.4 versions.2dCVE-2026-654887.1 HIG—
——0Unauthenticated Cross Site Request Forgery (CSRF) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.2d