PT-2026-31099 · WordPress · Quran Translations

Muhammad Afnaan · Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-4141

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Quran Translations plugin for WordPress versions up to and including 1.7

Description The plugin is susceptible to Cross-Site Request Forgery due to the absence of nonce validation in the quran playlist options() function. This function handles the plugin's settings page and processes POST requests to update plugin options via update option() without verifying the authenticity of the request. An unauthenticated attacker can modify plugin settings, such as display options for PDF, RSS, podcast, media player links, playlist title, and playlist code, by forging a request and tricking a site administrator into performing an action.

Recommendations Update the plugin to a version newer than 1.7.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4141

Affected Products

Quran Translations

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4141 · Security Note
• https://twitter.com/CVEnew/status/2043561059361943565 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e30379bf-0ea1-4443-81bb-4337a0311ed3?source=cve · Note
• https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/trunk/playlist.php#L143 · Note
• https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/tags/1.7/playlist.php#L167 · Note
• https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/trunk/playlist.php#L167 · Note
• https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/tags/1.7/playlist.php#L143 · Note