CVE-2026-4071

The BirdSeed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing nonce validation in the birdseed_plugin_settings_page() function. The function processes the 'birdseed_token' GET parameter and saves it to the database via update_option() without verifying a nonce. This makes it possible for unauthenticated attackers to change the plugin's BirdSeed token setting via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/birdseed/tags/2.2.0/birdseed.php#L42
• https://plugins.trac.wordpress.org/browser/birdseed/tags/2.2.0/birdseed.php#L43
• https://plugins.trac.wordpress.org/browser/birdseed/trunk/birdseed.php#L42
• https://plugins.trac.wordpress.org/browser/birdseed/trunk/birdseed.php#L43
• https://www.wordfence.com/threat-intel/vulnerabilities/id/236f5a78-435a-48d1-9dd7-c42a2155cb88?source=cve

Published

Jun 2, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40699A vulnerability exists in the undisclosed pages in the Confi…7.1
• CVE-2026-4070The Alfie – Feed Plugin plugin for WordPress is vulnerable t…4.3
• CVE-2026-40701NGINX Plus and NGINX Open Source have a vulnerability in the…6.3
• CVE-2026-40702WebSocket endpoints lack proper authentication mechanisms, e…9.4
• CVE-2026-40703A cross-site request forgery (CSRF) vulnerability exists in …5.4
• CVE-2026-40706In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflo…8.4
• CVE-2026-40711Dell Dell Container Storage Modules, version(s) csi-powersto…8
• CVE-2026-40712Dell PowerProtect Data Manager, versions prior to 20.2.0.0, …7.2
• CVE-2026-40713Dell ThinOS 10, versions prior to ThinOS10 2602_10.0765, con…6.1
• CVE-2026-40714Dell PowerProtect Data Manager, versions prior to 20.2.0.0, …7.2
• CVE-2026-40715Dell ThinOS 10, versions prior to ThinOS10 2602_10.0765, con…7.8
• CVE-2026-40717Dell Monitor driver, version 1.0.0.0, contains an Improper L…7.8