PT-2026-47681 · WordPress · Wpmobi

Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-8909

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WpMobi versions prior to 0.0.4

Description The WpMobi plugin for WordPress is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs due to missing or incorrect nonce validation in the handleSaveGeneralSettings() function. Unauthenticated attackers can modify the General Settings and inject arbitrary web scripts into the administrator's browser through the unescaped app name attribute reflection via a forged request. The script executes even if the app name value fails validation and is not saved to the database, as the form re-renders using the attacker-supplied in-memory value upon failure.

Recommendations Update to a version later than 0.0.3. As a temporary workaround, restrict access to the handleSaveGeneralSettings() function to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-8909

Affected Products

Wpmobi

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-8909 · Security Note
• https://t.me/CVEtracker/56258 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-mobi/trunk/admin_panel/CWpMobiGeneralSettings.class.php#L37 · Note
• https://twitter.com/VulmonFeeds/status/2064231242447429758 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-mobi/trunk/core/CCore.class.php#L61 · Note
• https://plugins.trac.wordpress.org/browser/wp-mobi/trunk/admin_panel/views/general_settings.php#L12 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5fbd1c5c-d23a-4f89-9225-514552d6ea70?source=cve · Note