CVE-2026-1072

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1072", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-16T20:15:03.326Z", "datePublished": "2026-02-18T05:29:17.672Z", "dateUpdated": "2026-04-08T16:51:02.200Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:02.200Z"}, "affected": [{"vendor": "jamesits", "product": "Keybase.io Verification", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missing nonce validation when updating plugin settings. This makes it possible for unauthenticated attackers to update the Keybase verification text via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4bbf55eb-7738-4c52-ac9d-a67d159e56cf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-keybase-verification/trunk/admin/code/write.php#L51"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-keybase-verification/tags/1.4.5/admin/code/write.php#L51"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3455171%40wp-keybase-verification&new=3455171%40wp-keybase-verification&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Afnaan"}], "timeline": [{"time": "2026-01-19T13:02:16.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-17T17:15:50.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T12:25:15.396275Z", "id": "CVE-2026-1072", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:53:01.683Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1072", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T12:25:15.396275Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:25:16.548Z"}}], "cna": {"title": "Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Afnaan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "jamesits", "product": "Keybase.io Verification", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-19T13:02:16.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-17T17:15:50.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4bbf55eb-7738-4c52-ac9d-a67d159e56cf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-keybase-verification/trunk/admin/code/write.php#L51"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-keybase-verification/tags/1.4.5/admin/code/write.php#L51"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3455171%40wp-keybase-verification&new=3455171%40wp-keybase-verification&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missing nonce validation when updating plugin settings. This makes it possible for unauthenticated attackers to update the Keybase verification text via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:02.200Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1072", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:02.200Z", "dateReserved": "2026-01-16T20:15:03.326Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T05:29:17.672Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Keybase.io Verification", "vendor": "jamesits", "versions": [{"lessThanOrEqual": "1.4.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missing nonce validation when updating plugin settings. This makes it possible for unauthenticated attackers to update the Keybase verification text via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Keybase.io Verification para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.4.5, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce al actualizar la configuraci\u00f3n del plugin. Esto hace posible que atacantes no autenticados actualicen el texto de verificaci\u00f3n de Keybase a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-1072", "lastModified": "2026-06-17T10:14:56.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1072", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T12:25:15.396275Z", "version": "2.0.3"}}]}, "published": "2026-02-18T06:16:33.740", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-keybase-verification/tags/1.4.5/admin/code/write.php#L51"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-keybase-verification/trunk/admin/code/write.php#L51"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3455171%40wp-keybase-verification&new=3455171%40wp-keybase-verification&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4bbf55eb-7738-4c52-ac9d-a67d159e56cf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Keybase.io Verification", "source": "cna", "vendor": "jamesits"}, "product": "keybase.io_verification", "vendor": "jamesits"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 70.0, "confidence_source": "inferred", "scores": [{"score": 70.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:19:21.136446+00:00", "value": {"mitigation_remediation": ["Upgrade the Keybase.io Verification plugin to the latest available version that includes nonce validation for settings updates (at minimum 1.4.6 or newer).", "If an upgrade is not immediately possible, remove or deactivate the plugin until a patched version is installed, to eliminate the CSRF surface.", "As a temporary workaround, modify the plugin\u2019s settings handling code (write.php) to add a valid WordPress nonce check before processing updates, or patch the file to include the nonce logic manually.", "Reinforce administrative security hygiene by training administrators to avoid clicking untrusted links and by implementing extra CSRF protection mechanisms such as a web application firewall that checks for proper nonces."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Plugin Settings Modification"}, "threat_synthesis": {"affected_systems": "This weakness affects the Keybase.io Verification plugin developed by jamesits, which is available for WordPress installations. All plugin releases up to and including version 1.4.5 are susceptible. Administrators of WordPress sites that have installed any of these affected versions are therefore exposed.", "description_and_impact": "The vulnerability is a classic Cross\u2011Site Request Forgery flaw that arises because the plugin does not validate the WordPress nonce when updating its settings. As a result, an attacker can craft a forged HTTP request that, if successfully delivered to the administrative interface, will modify the Keybase verification text stored by the plugin.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a medium severity level, but the EPSS score of less than 1% shows that real\u2011world exploitation is currently very unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to trick a site administrator into clicking a malicious link or otherwise submitting a forged request; the configuration requires the target to be logged in with administrative privileges. While the potential impact is limited to the internal verification text, the lack of authentication checks means the attacker can alter or remove verification content, undermining the plugin\u2019s integrity."}}}}, "created": "2026-02-18T10:32:46.506112+00:00", "updated": "2026-04-15T18:30:10.937807+00:00", "vendors": ["jamesits", "jamesits$PRODUCT$keybase.io_verification", "wordpress", "wordpress$PRODUCT$wordpress"]}