CVE-2026-3565

The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to a missing nonce verification in the taqnix_delete_my_account() function, where the check_ajax_referer() call is explicitly commented out on line 883. This makes it possible for unauthenticated attackers to trick a logged-in non-administrator user into deleting their own account via a forged request granted they can trick the user into performing an action such as clicking a link or visiting a malicious page.

• CWE-352

• https://plugins.trac.wordpress.org/browser/taqnix/tags/1.0.3/public/class-taqnix-user.php#L67
• https://plugins.trac.wordpress.org/browser/taqnix/tags/1.0.3/public/class-taqnix-user.php#L883
• https://plugins.trac.wordpress.org/browser/taqnix/tags/1.0.3/public/class-taqnix-user.php#L916
• https://plugins.trac.wordpress.org/browser/taqnix/trunk/public/class-taqnix-user.php#L67
• https://plugins.trac.wordpress.org/browser/taqnix/trunk/public/class-taqnix-user.php#L883
• https://plugins.trac.wordpress.org/browser/taqnix/trunk/public/class-taqnix-user.php#L916
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3491080%40taqnix&new=3491080%40taqnix&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/82aeab24-3467-4cb0-b71f-b7f97c26dc80?source=cve

Published

Apr 24, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35644OpenClaw before 2026.3.22 contains an information disclosure…7.1
• CVE-2026-35645OpenClaw before 2026.3.25 contains a privilege escalation vu…8.8
• CVE-2026-35646OpenClaw before 2026.3.25 contains a pre-authentication rate…6.5
• CVE-2026-35647OpenClaw before 2026.3.25 contains an access control vulnera…6.9
• CVE-2026-35648OpenClaw before 2026.3.22 contains a policy bypass vulnerabi…5.9
• CVE-2026-35649OpenClaw before 2026.3.22 contains a settings reconciliation…6.5
• CVE-2026-35650OpenClaw before 2026.3.22 contains an environment variable o…8.8
• CVE-2026-35651OpenClaw versions 2026.2.13 through 2026.3.24 contain an ANS…5.3
• CVE-2026-35652OpenClaw before 2026.3.22 contains an authorization bypass v…9.1
• CVE-2026-35653OpenClaw before 2026.3.24 contains an incorrect authorizatio…8.1
• CVE-2026-35654OpenClaw before 2026.3.25 contains an authorization bypass v…6.9
• CVE-2026-35655OpenClaw before 2026.3.22 contains an identity spoofing vuln…6.9