PT-2026-34863 · Taqnix · Taqnix

Youcef Hamdani · Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-3565

NVD

CVSS v3.1

4.3

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to a missing nonce verification in the taqnix delete my account() function, where the check ajax referer() call is explicitly commented out on line 883. This makes it possible for unauthenticated attackers to trick a logged-in non-administrator user into deleting their own account via a forged request granted they can trick the user into performing an action such as clicking a link or visiting a malicious page.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-3565

Affected Products

Taqnix

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-3565 · Security Note
• https://plugins.trac.wordpress.org/browser/taqnix/tags/1.0.3/public/class-taqnix-user.php#L883 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3491080%40taqnix&new=3491080%40taqnix&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/taqnix/trunk/public/class-taqnix-user.php#L67 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/82aeab24-3467-4cb0-b71f-b7f97c26dc80?source=cve · Note
• https://plugins.trac.wordpress.org/browser/taqnix/tags/1.0.3/public/class-taqnix-user.php#L916 · Note
• https://plugins.trac.wordpress.org/browser/taqnix/tags/1.0.3/public/class-taqnix-user.php#L67 · Note
• https://plugins.trac.wordpress.org/browser/taqnix/trunk/public/class-taqnix-user.php#L916 · Note
• https://plugins.trac.wordpress.org/browser/taqnix/trunk/public/class-taqnix-user.php#L883 · Note