PT-2026-50827 · Adamsilverstein · User Admin Simplifier
Ryusei Arima
·
Published
2026-06-19
·
Updated
2026-06-19
·
CVE-2026-11775
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
User Admin Simplifier versions prior to 3.0.1
Description
The User Admin Simplifier plugin for WordPress is subject to Cross-Site Request Forgery (CSRF), a type of attack where an unauthorized user tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation in the
useradminsimplifier options page function. Unauthenticated attackers can reset and permanently delete any user's stored menu and admin-bar configuration by tricking a site administrator into clicking a link. This action triggers the uas save admin options() function and overwrites the useradminsimplifier options database entry.Recommendations
Update the plugin to a version later than 3.0.0.
As a temporary workaround, restrict administrative access to the
useradminsimplifier options page function until the update is applied.Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
User Admin Simplifier