CVE-2026-3772

The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorPlugins.php#L60
• https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorThemes.php#L103
• https://plugins.trac.wordpress.org/changeset/3480577/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=cve

Published

May 1, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-37700Cross Site Scripting vulnerability in MaxSite CMS v.109.2 al…4.1
• CVE-2026-37709Insecure Permissions vulnerability in grokability snipe-it v…9.8
• CVE-2026-3771A vulnerability has been found in SourceCodester/janobe Reso…8.8
• CVE-2026-37711An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v…7.3
• CVE-2026-37712An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v…7.3
• CVE-2026-37713An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v…7.3
• CVE-2026-3773The Accessibility Suite by Ability, Inc plugin for WordPress…6.5
• CVE-2026-37737sanic-cors version 2.2.0 and prior contains an improper regu…6.5
• CVE-2026-3774The application allows PDF JavaScript and document/print act…7.5
• CVE-2026-37748Visitor Management System 1.0 by sanjay1313 is vulnerable to…7.2
• CVE-2026-37749A SQL injection vulnerability in CodeAstro Simple Attendance…9.8
• CVE-2026-3775The application's update service, when checking for updates,…7.8