CVE-2026-2023

The WP Plugin Info Card plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0. This is due to missing nonce validation in the ajax_save_custom_plugin() function, which is disabled by prefixing the check with 'false &&'. This makes it possible for unauthenticated attackers to create or modify custom plugin entries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://github.com/DLXPlugins/wp-plugin-info-card/blob/0fe50d3ccb3d61d5d176fab9e9f280ac8bfd8614/php/Admin/Init.php#L390
• https://plugins.trac.wordpress.org/browser/wp-plugin-info-card/tags/6.2.0/php/Admin/Init.php#L390
• https://plugins.trac.wordpress.org/browser/wp-plugin-info-card/trunk/php/Admin/Init.php#L390
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3454992%40wp-plugin-info-card&new=3454992%40wp-plugin-info-card&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1213a21f-a9c1-4da3-99b5-4a5a0673073f?source=cve

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-20217A vulnerability in the PESpin file format parser of ClamAV c…7.5
• CVE-2026-20219A vulnerability in the REST API of Cisco Slido could have al…5.4
• CVE-2026-2022The Smart Forms plugin for WordPress is vulnerable to unauth…4.3
• CVE-2026-20220A vulnerability in the web-based management interface of Cis…6.3
• CVE-2026-20223A vulnerability in the access validation of internal RE…10
• CVE-2026-20224A vulnerability in the web UI of Cisco Catalyst SD-WAN Manag…8.6
• CVE-2026-20230A vulnerability in Cisco Unified Communications Manager (Uni…8.6
• CVE-2026-20233A vulnerability in the web-based user interface of Cisco Web…6.1
• CVE-2026-20238In Splunk AI Toolkit versions below 5.7.3, a low-privileged …6.5
• CVE-2026-20239In Splunk Enterprise versions below 10.2.2 and 10.0.5, and S…6.5
• CVE-2026-2024The PhotoStack Gallery plugin for WordPress is vulnerable to…7.5
• CVE-2026-20240In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, …6.5