CVE-2026-3772
Published: 01 May 2026
Summary
CVE-2026-3772 is a high-severity CSRF (CWE-352) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-3772 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the WP Editor plugin for WordPress in all versions up to and including 1.2.9.2. The issue stems from missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions within the plugin's classes/WPEditorPlugins.php and classes/WPEditorThemes.php files. This flaw has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for network-based exploitation with low complexity and no privileges required, though user interaction is needed.
Unauthenticated attackers can exploit this vulnerability by crafting a forged request that tricks a site administrator into performing an action, such as clicking a malicious link. Successful exploitation allows the attacker to overwrite arbitrary PHP files in plugins and themes with attacker-controlled code, potentially leading to remote code execution, full site compromise, or persistent backdoor installation on the targeted WordPress site.
Mitigation details are outlined in related advisories and patches, including Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=cve. A fix is implemented in WordPress plugins trac changeset 3480577 at https://plugins.trac.wordpress.org/changeset/3480577/, which security practitioners should apply by updating the WP Editor plugin beyond version 1.2.9.2. The vulnerable code locations are documented at https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorPlugins.php#L60 and https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorThemes.php#L103.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26497
Vulnerability details
The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers…
more
to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vuln in public-facing WP plugin enables exploitation via malicious link to overwrite PHP files for web shell installation and RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires protections for session authenticity, such as anti-CSRF tokens or nonces, directly preventing forged requests that exploit the missing nonce verification in the WP Editor plugin.
SI-10 mandates input validation at entry points, including verification of nonces for state-changing operations like file overwrites in the vulnerable add_plugins_page and add_themes_page functions.
SI-2 ensures timely identification, reporting, and remediation of flaws, such as updating the WP Editor plugin beyond version 1.2.9.2 to apply the nonce verification fix.