WP Editor Plugin Vulnerability (CVE-2026-3772)

6 months ago

On this page

Security Alert Summary

The WP Editor plugin for WordPress has a cross-site request forgery (CSRF) vulnerability that affects all versions up to and including 1.2.9.2. Missing nonce verification in specific functions can allow an attacker to cause an administrator to overwrite plugin or theme PHP files via a forged request if the administrator performs an action such as clicking a link.

CVE Details

CVE ID: CVE-2026-3772
Affected component: WP Editor plugin for WordPress
Affected versions: All versions up to, and including, 1.2.9.2
Published: May 1, 2026 at 12:16:16 PM UTC
Last modified: May 1, 2026 at 3:26:24 PM UTC
CVSS v3.1: Base Score 8.8, Severity: HIGH
- Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Authentication / privileges / user interaction:
- Authentication required: None
- Privileges required: None
- User interaction: Required (an administrator must be tricked into performing an action)
Primary impact: Confidentiality: High; Integrity: High; Availability: High
Weakness (CWE): CWE-352 (Cross-Site Request Forgery)

Technical Details

The vulnerability is a cross-site request forgery (CSRF) caused by missing nonce verification in the plugin’s code. Specifically, nonce checks are missing in the add_plugins_page and add_themes_page functions. Because these server-side entry points do not validate a nonce, an attacker can craft a request that, when performed by an authenticated administrator (for example by clicking a link), will overwrite arbitrary plugin or theme PHP files with attacker-controlled code.

The scope of impact described in the report is file overwrite of plugin and theme PHP files. The exploit requires an administrator to perform an action that triggers the vulnerable code path; the attacker does not need prior authentication but relies on social engineering to induce the administrator to interact with the malicious request.

How This Could Impact Your Website

In a typical small business WordPress site, the site owner or an administrator manages plugins and themes, while internal staff or external contractors may have contributor or editor roles. If an administrator is tricked into activating a crafted request, an attacker could overwrite PHP files in plugins or themes. Practical consequences include injection of malicious code, which could be used to exfiltrate data or create persistent backdoors.

Potential real-world effects include exposure of sensitive information (such as internal user details), increased risk of targeted phishing or social engineering against staff and contractors, and unauthorized modifications that may disrupt site functionality. The attack relies on social engineering of an administrator rather than a direct breach of credentials.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

Update the affected plugin as soon as a patched version is available.
Review and reduce unnecessary user roles, especially contributors and editors with elevated capabilities.
Enforce strong passwords and enable two-factor authentication for editors and administrators.
Remove unused or unmaintained plugins and themes from the site.
Monitor site activity and file integrity for unusual behavior, such as unexpected changes to plugin or theme files.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughi https://freshysites.com/team/nick-paliughi/

Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.