CVE-2026-8909

The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to missing or incorrect nonce validation on the handleSaveGeneralSettings function. This makes it possible for unauthenticated attackers to modify the plugin's General Settings and inject arbitrary web scripts into the administrator's browser via the unescaped app_name attribute reflection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected script executes even when the supplied app_name value fails validation and is not persisted to the database, because the form is re-rendered with the attacker-supplied in-memory value on validation failure.

• CWE-352

• https://plugins.trac.wordpress.org/browser/wp-mobi/trunk/admin_panel/CWpMobiGeneralSettings.class.php#L37
• https://plugins.trac.wordpress.org/browser/wp-mobi/trunk/admin_panel/views/general_settings.php#L12
• https://plugins.trac.wordpress.org/browser/wp-mobi/trunk/core/CCore.class.php#L61
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbd1c5c-d23a-4f89-9225-514552d6ea70?source=cve

Published

Jun 9, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89082HP has identified potential security vulnerabilities in the …9.3
• CVE-2026-89083HP has identified potential security vulnerabilities in the …9.3
• CVE-2026-89084HP has identified potential security vulnerabilities in the …8.8
• CVE-2026-89086In the jose package before 0.11.0 for OCaml, library calls t…9.1
• CVE-2026-89087The cstruct package before 6.3.0 for OCaml mishandles indexe…7.3
• CVE-2026-89089A SQL injection vulnerability exists in the JasperReports-ba…6.5
• CVE-2026-89090An unrecovered panic in the event stream header decoder in A…5.9
• CVE-2026-89092The nscd service in the GNU C Library 2.3.4 onwards may cras…4.2
• CVE-2026-89093The Better Messages – Chat Rooms, Group Chat, Private Messag…5.3
• CVE-2026-89094Forgejo before 16.0.4 allows remote code execution via a cra…9.9
• CVE-2026-89099A race condition in the document value layer of MongoDB Serv…7.5
• CVE-2026-8910The WP Emoticon Rating plugin for WordPress is vulnerable to…6.1