PT-2026-34294 · WordPress · Textp2P Texting Widget

Muhammad Afnaan · Published 2026-04-22 · Updated 2026-05-01 · CVE-2026-4133

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions TextP2P Texting Widget versions prior to 1.8

Description The TextP2P Texting Widget plugin for WordPress is susceptible to Cross-Site Request Forgery. This occurs because the imTextP2POptionPage() function, which handles settings updates, lacks nonce validation. Specifically, the form does not include a wp nonce field(), and the POST handler fails to call check admin referer() or wp verify nonce() before processing changes. This allows unauthenticated attackers to update plugin settings, including chat widget titles, messages, API credentials, colors, and reCAPTCHA configuration, by tricking a site administrator into clicking a malicious link.

Recommendations Update the plugin to a version later than 1.7.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4133

Affected Products

Textp2P Texting Widget

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4133 · Security Note
• https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/trunk/inc/admin/im-textp2p-options.php#L299 · Note
• https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/tags/1.7/inc/admin/im-textp2p-options.php#L299 · Note
• https://twitter.com/CVEnew/status/2047428133599801484 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2d36fa25-108b-462b-b84e-2e77943b1871?source=cve · Note
• https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/trunk/inc/admin/im-textp2p-options.php#L7 · Note
• https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/tags/1.7/inc/admin/im-textp2p-options.php#L7 · Note
• https://reddit.com/r/StopBadBots/comments/1t0qbbs/critical_alert_20_unpatched_wordpress · Reddit Post