PT-2026-36318 · WordPress · Wp Editor

Jack Pas · Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-3772

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Editor versions prior to 1.2.9.3

Description The WP Editor plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs because the add plugins page() and add themes page() functions lack nonce verification (a unique token used to prevent replay attacks). Consequently, unauthenticated attackers can overwrite arbitrary plugin and theme PHP files with malicious code by inducing a site administrator to click a forged link.

Recommendations Update to a version later than 1.2.9.2. As a temporary workaround, restrict access to the add plugins page() and add themes page() functions to minimize the risk of exploitation.

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-3772

Affected Products

Wp Editor

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-3772 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorThemes.php#L103 · Note
• https://t.me/CVEtracker/52406 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorPlugins.php#L60 · Note
• https://twitter.com/VulmonFeeds/status/2050207748931887283 · Twitter Post
• https://twitter.com/infoflowcloud/status/2050183893832057288 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2050191008424472755 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=cve · Note
• https://twitter.com/CVEnew/status/2050182537616429412 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3480577 · Note