PT-2026-45706 · WordPress · Birdseed

Nabil Irawan · CVE-2026-4071 · Published 2026-06-02 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions BirdSeed versions prior to 2.2.1

Description The BirdSeed plugin for WordPress is subject to Cross-Site Request Forgery. This occurs because the birdseed plugin settings page() function fails to perform nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user. The function processes the birdseed token GET parameter and saves it to the database using update option() without verification. Consequently, unauthenticated attackers can modify the plugin's BirdSeed token setting by tricking a site administrator into clicking a malicious link.

Recommendations Update to a version later than 2.2.0. As a temporary workaround, restrict administrative access to the plugin settings page to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4071

Affected Products

Birdseed

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-4071 · Security Note
• https://plugins.trac.wordpress.org/browser/birdseed/trunk/birdseed.php#L42 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/236f5a78-435a-48d1-9dd7-c42a2155cb88?source=cve · Note
• https://plugins.trac.wordpress.org/browser/birdseed/tags/2.2.0/birdseed.php#L42 · Note
• https://reddit.com/r/StopBadBots/comments/1u38lfq/25_unpatched_wordpress_plugins_remove_them_today · Reddit Post
• https://plugins.trac.wordpress.org/browser/birdseed/trunk/birdseed.php#L43 · Note
• https://t.me/CVEtracker/55572 · Telegram Post
• https://plugins.trac.wordpress.org/browser/birdseed/tags/2.2.0/birdseed.php#L43 · Note
• https://twitter.com/VulmonFeeds/status/2061767274038517913 · Twitter Post