CVE-2026-6294

The Google PageRank Display plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4. This is due to missing nonce validation in the gpdisplay_option() function, which handles the plugin settings page. The settings form does not include a wp_nonce_field(), and the form handler does not call check_admin_referer() or wp_verify_nonce() before processing the POST request. This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a crafted request that changes the plugin's settings (stored via update_option()), such as the display style used to render the PageRank badge.

• CWE-352

• https://plugins.trac.wordpress.org/browser/google-pagerank-display/tags/1.4/gpdisplay.php#L32
• https://plugins.trac.wordpress.org/browser/google-pagerank-display/tags/1.4/gpdisplay.php#L56
• https://plugins.trac.wordpress.org/browser/google-pagerank-display/trunk/gpdisplay.php#L32
• https://plugins.trac.wordpress.org/browser/google-pagerank-display/trunk/gpdisplay.php#L56
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e39ebe27-7780-48b6-8dca-7da7a78fce69?source=cve

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62917Improper input validation in Microsoft Office SharePoint all…4.6
• CVE-2026-62918Improper verification of cryptographic signature in Microsof…7.5
• CVE-2026-6292The MP Customize Login Page plugin for WordPress is vulnerab…4.3
• CVE-2026-62927In Eclipse Milo versions 1.0.0 through 1.1.4, the Call servi…7.5
• CVE-2026-62928XING CPTrans-ME-X contains an OS Command Injection (CWE-78).…9.3
• CVE-2026-6293The Inquiry Form to Posts or Pages plugin for WordPress is v…4.3
• CVE-2026-62940Incus is a system container and virtual machine manager. Pri…9.9
• CVE-2026-62941Incus is a system container and virtual machine manager. Pri…9.9
• CVE-2026-62943btrbk is a tool for creating snapshots and remote backups of…8.7
• CVE-2026-62945TREK is a collaborative travel planner. Prior to 3.1.3, TREK…4.3
• CVE-2026-62946ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-62947OpenWrt is a Linux operating system targeting embedded devic…4.9