PT-2026-43497 · WordPress · Old Posts Highlighter

Muhammad Afnaan · Published 2026-05-27 · Updated 2026-06-04 · CVE-2026-7614

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Old Posts Highlighter versions prior to 1.0.4

Description The Old Posts Highlighter plugin for WordPress is susceptible to Cross-Site Request Forgery, a type of attack where an unauthorized user tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation within the OPH options() function. Consequently, unauthenticated attackers can update the plugin configuration settings without authorization by inducing a site administrator to click a malicious link.

Recommendations Update the plugin to a version later than 1.0.3. As a temporary workaround, restrict access to the OPH options() function to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-7614

Affected Products

Old Posts Highlighter

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-7614 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c186d5eb-abc2-47bd-9d3c-2b2f24d2f87e?source=cve · Note
• https://plugins.trac.wordpress.org/browser/old-posts-highlighter/tags/1.0.3/OPH_admin.php#L163 · Note
• https://plugins.trac.wordpress.org/browser/old-posts-highlighter/trunk/OPH_admin.php#L37 · Note
• https://reddit.com/r/StopBadBots/comments/1twww49/insane_record_145_wordpress_plugins_exposed_with · Reddit Post
• https://plugins.trac.wordpress.org/browser/old-posts-highlighter/tags/1.0.3/OPH_admin.php#L37 · Note
• https://t.me/cveNotify/164802 · Telegram Post
• https://plugins.trac.wordpress.org/browser/old-posts-highlighter/trunk/OPH_admin.php#L163 · Note