CVE-2026-1085

The True Ranker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.9. This is due to missing nonce validation on the seolocalrank-signout action. This makes it possible for unauthenticated attackers to disconnect the administrator's True Ranker account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.9/admin/class-seolocalrank-admin.php#L768
• https://plugins.trac.wordpress.org/browser/seo-local-rank/trunk/admin/class-seolocalrank-admin.php#L768
• https://www.wordfence.com/threat-intel/vulnerabilities/id/db27ae52-1362-4acb-9410-49ad041770f6?source=cve

Published

Mar 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10843A flaw was found in the OpenShift Cloud Credential Operator …7.2
• CVE-2026-10845IBM WebSphere Application Server 8.5 and 9.0 could allow a r…7.3
• CVE-2026-10846NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, wh…7.5
• CVE-2026-10847A local privilege escalation vulnerability exists in Check P…7.8
• CVE-2026-10848The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WA…8.6
• CVE-2026-10849The hawkBit device management client in subsys/mgmt/hawkbit …7.5
• CVE-2026-10850Plane CE 1.3.1 allows a low-privileged project member to sub…5.4
• CVE-2026-10852IBM WebSphere Application Server and IBM WebSphere Applicati…7.5
• CVE-2026-10854A visibility control issue in the event template creation wo…4.3
• CVE-2026-10855An authorization flaw existed in the MISP Event Template Imp…4.3
• CVE-2026-10856A URL validation flaw in the MISP dashboard button widget al…6.1
• CVE-2026-10857Improper neutralization of input during web page generation …6.1