Security Alert Summary
The Petje.af plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 2.1.8. A missing nonce validation in the plugin’s AJAX handler allows an attacker to cause authenticated users to perform destructive actions, including revoking OAuth2 tokens, deleting user meta, and deleting user accounts assigned the petjeaf_member role, via a forged request if the victim interacts with a malicious link or site.
CVE Details
- CVE ID: CVE-2026-4002
- Affected component: Petje.af plugin for WordPress
- Affected versions: All versions up to and including 2.1.8
- Published: April 15, 2026 at 9:16 AM UTC
- Last modified: April 15, 2026 at 9:16 AM UTC
- CVSS v3.1: Base Score 4.3 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction: Privileges Required: NONE; User Interaction: REQUIRED; Attack Vector: NETWORK; Attack Complexity: LOW
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-352 (Cross-Site Request Forgery)
Technical Details
The vulnerability is a Cross-Site Request Forgery caused by missing nonce validation in the ajax_revoke_token() function, which handles the petjeaf_disconnect AJAX action. Because the function does not verify that the request originates from an authenticated and intended source, an attacker can craft a forged request that triggers the handler when an authenticated site user visits a malicious page or clicks a link.
The ajax_revoke_token() implementation performs destructive operations: revoking OAuth2 tokens, deleting user meta, and deleting WordPress user accounts for users with the petjeaf_member role. Without a nonce check or other origin validation, these actions can be triggered by an attacker using the victim’s authenticated session.
How This Could Impact Your Website
Consider a site with a site owner, an internal staff member who manages content, and an external contractor who logs in to perform integrations. If an attacker crafts a malicious link and an authenticated staff member or contractor visits it, the site could revoke OAuth2 tokens tied to accounts, remove related user meta, and delete users assigned the petjeaf_member role. This may disrupt integrations that rely on OAuth tokens and remove members from the site, creating administrative overhead to restore accounts and data.
Consequences can include exposure to targeted follow-up attacks (for example, social engineering) due to disrupted integrations or loss of member accounts. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and any special roles like
petjeaf_member. - Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity and logs for unusual behavior, such as unexpected account deletions or revoked tokens.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/petje-af/tags/2.1.8/includes/class-petje-af-oauth2-provider.php#L326
- https://plugins.trac.wordpress.org/browser/petje-af/tags/2.1.8/includes/class-petje-af-oauth2-provider.php#L346
- https://plugins.trac.wordpress.org/browser/petje-af/tags/2.1.8/includes/class-petje-af.php#L182
- https://plugins.trac.wordpress.org/browser/petje-af/trunk/includes/class-petje-af-oauth2-provider.php#L326
- https://plugins.trac.wordpress.org/browser/petje-af/trunk/includes/class-petje-af-oauth2-provider.php#L346
- https://plugins.trac.wordpress.org/browser/petje-af/trunk/includes/class-petje-af.php#L182
- https://www.wordfence.com/threat-intel/vulnerabilities/id/28a071ac-37ee-4fb9-b8c6-0a782ee673b4?source=cve
