PT-2026-42080 · WordPress · Remove Yellow Bgbox

Ibnu + 1 · CVE-2026-8424 · Published 2026-05-20 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Remove Yellow BGBOX versions prior to 1.1

Description The Remove Yellow BGBOX plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation on the 'rybb api settings' page. Unauthenticated attackers can exploit this to reset stored settings by overwriting the plugin configuration if a site administrator is deceived into clicking a malicious link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-8424

Affected Products

Remove Yellow Bgbox

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-8424 · Security Note
• https://reddit.com/r/StopBadBots/comments/1tqd1k6/critical_38_plugins_no_fix_no_mercy_if_youve_got · Reddit Post
• https://plugins.trac.wordpress.org/browser/remove-yellow-bgbox/tags/1.0/admin/rybb_api_settings.php#L5 · Note
• https://plugins.trac.wordpress.org/browser/remove-yellow-bgbox/trunk/admin/rybb_api_settings.php#L5 · Note
• https://plugins.trac.wordpress.org/browser/remove-yellow-bgbox/trunk/includes/functions.php#L16 · Note
• https://t.me/CVEtracker/54328 · Telegram Post
• https://plugins.trac.wordpress.org/browser/remove-yellow-bgbox/tags/1.0/includes/functions.php#L16 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c5b30d27-a3f8-4535-a47f-675c939ec648?source=cve · Note