PT-2026-34310 · WordPress · Fast & Fancy Filter – 3F

Published 2026-04-22 · Updated 2026-05-01 · CVE-2026-6396

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fast & Fancy Filter – 3F plugin for WordPress versions prior to 1.2.3

Description Cross-Site Request Forgery occurs due to missing nonce verification in the saveFields() function, which handles the 'fff save settins' AJAX action. This allows unauthenticated attackers to modify plugin filter settings, update arbitrary options, or create new filter posts by tricking a site administrator into clicking a link.

Recommendations Update the plugin to a version later than 1.2.2. As a temporary workaround, restrict access to the saveFields() function until the update is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-6396

Affected Products

Fast & Fancy Filter – 3F

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-6396 · Security Note
• https://plugins.trac.wordpress.org/browser/fast-fancy-filter-3f/tags/1.2.2/includes/admin/class-admin.php#L419 · Note
• https://twitter.com/VulmonFeeds/status/2046899551580164561 · Twitter Post
• https://plugins.trac.wordpress.org/browser/fast-fancy-filter-3f/trunk/includes/admin/class-admin.php#L24 · Note
• https://plugins.trac.wordpress.org/browser/fast-fancy-filter-3f/trunk/includes/admin/class-admin.php#L419 · Note
• https://reddit.com/r/StopBadBots/comments/1t0qbbs/critical_alert_20_unpatched_wordpress · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4b5fbf2c-1231-482f-b5a5-819f31da3524?source=cve · Note
• https://twitter.com/CVEnew/status/2047428130852450496 · Twitter Post
• https://plugins.trac.wordpress.org/browser/fast-fancy-filter-3f/tags/1.2.2/includes/admin/class-admin.php#L24 · Note