CVE-2026-3903

The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing nonce validation on the postConfirmOauth() function. This makes it possible for unauthenticated attackers to disconnect the plugin's OAuth/SSO connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/changeset/3441222/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/913a94ad-f425-4d24-9e23-7074ecfed8ad?source=cve

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-38998A use-after-free in the SocketDescriptor::tcpReadHandler1 fu…6.5
• CVE-2026-38999A Null Pointer Dereference in the mk_sched_event_close funct…7.5
• CVE-2026-39006An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to e…9.8
• CVE-2026-39007An issue in Observeinc's Observe v.2026-01-28 and before all…7.5
• CVE-2026-3902An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.…7.5
• CVE-2026-39020An issue in WIngs3D v.2.4.1 allows a local attacker to cause…5.5
• CVE-2026-39031Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption…5.5
• CVE-2026-39038BharatMLStack up to and including v1.3.0 is vulnerable to Cr…6.1
• CVE-2026-39039In BharatMLStack up to and including v1.3.0, Trufflebox UI s…5.3
• CVE-2026-3904Calling NSS-backed functions that support caching via nscd m…6.2
• CVE-2026-39040BharatMLStack up to and including 1.3.0 is vulnerable to Cro…5.4
• CVE-2026-39042An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.…7.5