PT-2026-45713 · WordPress · Laiser Tag
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Laiser Tag versions prior to 1.2.6
Description
The Laiser Tag plugin for WordPress is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into executing unwanted actions. This occurs due to missing or incorrect nonce validation in the
addOptionsPageFields() function. Unauthenticated attackers can exploit this by tricking a site administrator into clicking a malicious link, allowing the attacker to update plugin settings such as the API key, tag blacklist, relevance threshold, batch size, and tagging toggles.Recommendations
Update the plugin to a version later than 1.2.5.
As a temporary workaround, restrict access to the plugin settings page to minimize the risk of exploitation.
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Laiser Tag