PT-2026-34863 · WordPress · Taqnix

Youcef Hamdani · Published 2026-04-24 · Updated 2026-04-25 · CVE-2026-3565

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Taqnix versions prior to 1.0.4

Description The Taqnix plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a user into performing actions they did not intend to. This occurs because of missing nonce verification in the taqnix delete my account() function, specifically where the check ajax referer() call is commented out. Unauthenticated attackers can exploit this to force logged-in non-administrator users to delete their own accounts by inducing them to click a malicious link or visit a compromised page.

Recommendations Update to a version later than 1.0.3. As a temporary workaround, restrict access to the taqnix delete my account() function until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-3565

Affected Products

Taqnix

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-3565 · Security Note
• https://plugins.trac.wordpress.org/browser/taqnix/tags/1.0.3/public/class-taqnix-user.php#L67 · Note
• https://plugins.trac.wordpress.org/browser/taqnix/trunk/public/class-taqnix-user.php#L916 · Note
• https://plugins.trac.wordpress.org/browser/taqnix/trunk/public/class-taqnix-user.php#L883 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3491080%40taqnix&new=3491080%40taqnix&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2048099305446154498 · Twitter Post
• https://plugins.trac.wordpress.org/browser/taqnix/tags/1.0.3/public/class-taqnix-user.php#L883 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/82aeab24-3467-4cb0-b71f-b7f97c26dc80?source=cve · Note
• https://plugins.trac.wordpress.org/browser/taqnix/tags/1.0.3/public/class-taqnix-user.php#L916 · Note
• https://plugins.trac.wordpress.org/browser/taqnix/trunk/public/class-taqnix-user.php#L67 · Note