CVE-2026-1087

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1087", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-16T20:48:38.649Z", "datePublished": "2026-03-07T07:22:09.002Z", "dateUpdated": "2026-04-08T17:30:42.779Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:42.779Z"}, "affected": [{"vendor": "openplatform", "product": "The Guardian News Feed", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Guardian News Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the Guardian API key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e9065f61-d899-44a3-a43a-3eeeeedaa6f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/the-guardian-news-feed/trunk/gu-open-platform-settings.php#L72"}, {"url": "https://plugins.trac.wordpress.org/browser/the-guardian-news-feed/tags/1.2/gu-open-platform-settings.php#L72"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-01-16T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T17:31:54.325225Z", "id": "CVE-2026-1087", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:27:41.190Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1087", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T17:31:54.325225Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T17:31:55.456Z"}}], "cna": {"title": "The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "openplatform", "product": "The Guardian News Feed", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-16T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e9065f61-d899-44a3-a43a-3eeeeedaa6f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/the-guardian-news-feed/trunk/gu-open-platform-settings.php#L72"}, {"url": "https://plugins.trac.wordpress.org/browser/the-guardian-news-feed/tags/1.2/gu-open-platform-settings.php#L72"}], "descriptions": [{"lang": "en", "value": "The Guardian News Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the Guardian API key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:42.779Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1087", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:30:42.779Z", "dateReserved": "2026-01-16T20:48:38.649Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-07T07:22:09.002Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "The Guardian News Feed", "vendor": "openplatform", "versions": [{"lessThanOrEqual": "1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Guardian News Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the Guardian API key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Guardian News Feed para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.2, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en la funcionalidad de actualizaci\u00f3n de ajustes. Esto hace posible que atacantes no autenticados modifiquen los ajustes del plugin, incluyendo la clave API de Guardian, a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-1087", "lastModified": "2026-06-17T10:14:58.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1087", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T17:31:54.325225Z", "version": "2.0.3"}}]}, "published": "2026-03-07T08:16:09.560", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/the-guardian-news-feed/tags/1.2/gu-open-platform-settings.php#L72"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/the-guardian-news-feed/trunk/gu-open-platform-settings.php#L72"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e9065f61-d899-44a3-a43a-3eeeeedaa6f1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "The Guardian News Feed", "source": "cna", "vendor": "openplatform"}, "product": "the_guardian_news_feed", "vendor": "openplatform"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T19:48:08.446874+00:00", "value": {"mitigation_remediation": ["Upgrade The Guardian News Feed plugin to the latest stable release, which adds nonce validation to the settings update endpoint.", "If an upgrade is not immediately possible, locate the file gu-open-platform-settings.php in the plugin\u2019s directory, comment out or remove the section that writes updated settings to the database, thereby disabling the vulnerable endpoint.", "After mitigating the CSRF risk, generate a new Guardian API key and replace the potentially compromised key in the plugin settings to prevent any credential leakage that might have occurred during an exploit.", "Optional: implement a site\u2011wide CSRF protection plugin or enable WordPress built\u2011in CSRF safeguards and restrict administrative access to a minimum set of trusted users."], "summary": {"action": "Patch", "impact": "Unauthenticated settings modification via CSRF"}, "threat_synthesis": {"affected_systems": "WordPress installations running openplatform\u2019s \"The Guardian News Feed\" plugin version 1.2 or earlier are affected. All releases up to and including 1.2 lack the necessary CSRF protection, so any site using these versions is vulnerable unless the plugin is upgraded or the not\u2011authorized settings endpoint is disabled.", "description_and_impact": "The Guardian News Feed plugin for WordPress suffers from a Cross\u2011Site Request Forgery vulnerability caused by the absence of nonce validation in its settings update routine. An unauthenticated attacker can trick a site administrator into performing a benign action, such as clicking a link, that triggers a forged request to the plugin\u2019s settings endpoint. The resulting request modifies the plugin\u2019s configuration, including the Guardian API key, without the administrator\u2019s explicit permission. This flaw is classified as CWE-352 and permits unauthorized configuration changes that may expose sensitive credentials and allow the attacker to change the behavior of the feed integration.", "risk_and_exploitability": "With a CVSS score of 4.3 the vulnerability is rated as moderate, and the EPSS score of less than 1\u202f% indicates a low likelihood of widespread exploitation at present. The flaw is not cataloged in the CISA KEV list, reflecting its limited exploitation history. Exploitation requires user interaction: the attacker must entice an administrator to perform a pre\u2011determined action, such as clicking a malicious link. While the vulnerability does not grant direct access to privileged functions beyond configuration changes, tampering with the API key could facilitate further compromise by allowing the attacker to impersonate the site in requests to the Guardian data service. The overall risk thus hinges on the likelihood of a successful social\u2011engineering campaign against site administrators."}}}}, "created": "2026-03-09T10:05:31.446124+00:00", "updated": "2026-04-15T20:00:06.602110+00:00", "vendors": ["openplatform", "openplatform$PRODUCT$the_guardian_news_feed", "wordpress", "wordpress$PRODUCT$wordpress"]}