Security Alert Summary
The WP Plugin Info Card plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 6.2.0. A missing nonce validation in the ajax_save_custom_plugin() function (the check is disabled by prefixing it with false &&) allows an unauthenticated attacker to create or modify custom plugin entries if they can trick a site administrator into performing an action such as clicking a crafted link.
CVE Details
- CVE ID: CVE-2026-2023
- Affected component: WP Plugin Info Card plugin for WordPress
- Affected versions: All versions up to and including 6.2.0
- Published: February 18, 2026 at 6:16:35 AM
- Last modified: February 18, 2026 at 6:16:35 AM
- CVSS v3.1: Base Score 4.3, Severity MEDIUM; Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Authentication / Privileges / User Interaction: Authentication required: No; Privileges required: None; User interaction: Required
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE / Weakness: CWE-352 (Cross-Site Request Forgery)
Technical Details
According to the CVE description, the vulnerability exists because nonce validation is missing in the ajax_save_custom_plugin() function. The nonce check is effectively disabled by prefixing it with false &&, so the function does not verify the request origin. As a result, an attacker can craft a request that, if an administrative user performs the required interaction (for example, by clicking a link), will create or modify custom plugin entries via the plugin’s AJAX handler.
The issue is a classic CSRF problem: the server-side check that would normally prevent unauthorized state changes is bypassed, allowing an attacker to induce a privileged user to perform an action that changes site data. The described impact is limited to integrity (unauthorized modification of plugin entries) and does not indicate direct confidentiality or availability loss.
How This Could Impact Your Website
In a typical site environment you might have a site owner, one or more internal staff members with administrative privileges, and external contractors or contributors. If an administrator is tricked into taking an action (for example, clicking a maliciously crafted link while logged into the WordPress admin), an attacker could add or alter custom plugin entries managed by WP Plugin Info Card. This could allow an attacker to display attacker-controlled content in plugin listings or introduce misleading information that aids social engineering or targeted phishing against staff or site users.
The risk is focused on unauthorized modification of plugin-related data rather than a full site compromise. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (If a fixed version is not specified in the CVE entry, check the plugin’s official repository or vendor advisory for updates.)
- Review and reduce unnecessary user roles, especially contributor and editor roles with elevated capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and plugin-related changes for unusual behavior, especially admin-initiated modifications.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/DLXPlugins/wp-plugin-info-card/blob/0fe50d3ccb3d61d5d176fab9e9f280ac8bfd8614/php/Admin/Init.php#L390
- https://plugins.trac.wordpress.org/browser/wp-plugin-info-card/tags/6.2.0/php/Admin/Init.php#L390
- https://plugins.trac.wordpress.org/browser/wp-plugin-info-card/trunk/php/Admin/Init.php#L390
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3454992%40wp-plugin-info-card&new=3454992%40wp-plugin-info-card&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1213a21f-a9c1-4da3-99b5-4a5a0673073f?source=cve
