PT-2026-45714 · WordPress · Google Plus One Bottom

Swat · CVE-2026-9723 · Published 2026-06-02 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Google Plus One Bottom versions prior to 0.0.3

Description The Google Plus One Bottom plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into executing unwanted actions. This occurs due to missing or incorrect nonce validation within the googlePlusOneAdmin() function. Unauthenticated attackers can modify plugin settings stored in the database, specifically the plusone-lang, plusone-callback, and plusone-url variables, by inducing a site administrator to click a malicious link.

Recommendations Update the plugin to a version later than 0.0.2. As a temporary workaround, restrict access to the googlePlusOneAdmin() function to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-9723

Affected Products

Google Plus One Bottom

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-9723 · Security Note
• https://twitter.com/atomicedgeWAF/status/2062055528402927707 · Twitter Post
• https://plugins.trac.wordpress.org/browser/google-plus-one-bottom/tags/0.0.2/googlePlusOne.php#L73 · Note
• https://plugins.trac.wordpress.org/browser/google-plus-one-bottom/tags/0.0.2/googlePlusOne.php#L34 · Note
• https://twitter.com/VulmonFeeds/status/2061751913637445718 · Twitter Post
• https://reddit.com/r/StopBadBots/comments/1u38lfq/25_unpatched_wordpress_plugins_remove_them_today · Reddit Post
• https://plugins.trac.wordpress.org/browser/google-plus-one-bottom/tags/0.0.2/googlePlusOne.php#L64 · Note
• https://t.me/CVEtracker/55580 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/43af2d38-72e8-405f-a910-500fb782ded2?source=cve · Note