CVE-2026-1208

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1208", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-19T20:41:46.581Z", "datePublished": "2026-01-24T09:08:07.475Z", "dateUpdated": "2026-04-08T16:59:16.495Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:16.495Z"}, "affected": [{"vendor": "mainichiweb", "product": "Friendly Functions for Welcart", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc709e0-870b-4d12-9ac8-55da498768a1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/friendly-functions-for-welcart/tags/1.2.5/ffw_function_settings.php#L53"}, {"url": "https://plugins.trac.wordpress.org/browser/friendly-functions-for-welcart/tags/1.2.5/ffw_function_settings.php#L58"}, {"url": "https://plugins.trac.wordpress.org/changeset/3445305/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "timeline": [{"time": "2026-01-23T20:32:39.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T17:41:07.930037Z", "id": "CVE-2026-1208", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T17:41:14.150Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1208", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T17:41:07.930037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T17:41:10.601Z"}}], "cna": {"title": "Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "mainichiweb", "product": "Friendly Functions for Welcart", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-23T20:32:39.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc709e0-870b-4d12-9ac8-55da498768a1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/friendly-functions-for-welcart/tags/1.2.5/ffw_function_settings.php#L53"}, {"url": "https://plugins.trac.wordpress.org/browser/friendly-functions-for-welcart/tags/1.2.5/ffw_function_settings.php#L58"}, {"url": "https://plugins.trac.wordpress.org/changeset/3445305/"}], "descriptions": [{"lang": "en", "value": "The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:16.495Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1208", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:59:16.495Z", "dateReserved": "2026-01-19T20:41:46.581Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-24T09:08:07.475Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Friendly Functions for Welcart", "vendor": "mainichiweb", "versions": [{"lessThanOrEqual": "1.2.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Friendly Functions para Welcart para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.2.5, inclusive. Esto se debe a una validaci\u00f3n de nonce faltante o incorrecta en la p\u00e1gina de configuraci\u00f3n. Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n del plugin a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-1208", "lastModified": "2026-06-17T10:15:19.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1208", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T17:41:07.930037Z", "version": "2.0.3"}}]}, "published": "2026-01-24T09:15:54.017", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/friendly-functions-for-welcart/tags/1.2.5/ffw_function_settings.php#L53"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/friendly-functions-for-welcart/tags/1.2.5/ffw_function_settings.php#L58"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3445305/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc709e0-870b-4d12-9ac8-55da498768a1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T21:38:12.757868+00:00", "value": {"mitigation_remediation": ["Upgrade Friendly Functions for Welcart to the latest available version (greater than 1.2.5) or remove the plugin if it is no longer required.", "Ensure that all administrative forms in WordPress use proper nonce fields to validate requests; if the plugin lacks this, consider implementing custom code or using a security extension that enforces nonce checks on plugin settings pages.", "Apply a general CSRF protection measure by enabling a security plugin that sanitizes or blocks forged form submissions to the admin area."], "summary": {"action": "Assess", "impact": "Cross\u2011Site Request Forgery (Settings Modification)"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the Friendly Functions for Welcart plugin with a version up to and including 1.2.5 is affected. The plugin is maintained by mainichiweb. No other vendor or product versions are known to be impacted.", "description_and_impact": "Friendly Functions for Welcart plugin for WordPress contains a CSRF vulnerability that allows an unauthenticated attacker to modify plugin settings on the settings page because the nonce validation is missing or incorrect. If the attacker convinces a site administrator to click a crafted link or perform an action, the attacker can alter configuration values that may affect how the plugin operates or how the site behaves. This could lead to compromised functionality and an attacker might leverage the altered settings to facilitate further attacks.", "risk_and_exploitability": "The CVSS base score of 4.3 indicates low severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA\u2019s KEV catalog. The impact is confined to the WordPress administrative context; an attacker must be able to coerce an authenticated administrator to perform an action. The lack of nonce validation on the settings page makes exploitation trivial when the attacker can supply a crafted link or form submission. The overall risk for an active-facing site that permits admins to log in is moderate because the attacker can gain administrative configuration changes without direct authentication."}}}}, "created": "2026-01-26T11:48:37.249370+00:00", "updated": "2026-04-15T21:45:14.146644+00:00", "vendors": ["mainichiweb", "mainichiweb$PRODUCT$friendly_functions_for_welcart", "wordpress", "wordpress$PRODUCT$wordpress"]}