CVE-2026-1380

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1380", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-23T18:34:44.736Z", "datePublished": "2026-01-28T11:23:39.083Z", "dateUpdated": "2026-04-08T16:47:28.346Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:28.346Z"}, "affected": [{"vendor": "lxicon", "product": "Bitcoin Donate Button", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Bitcoin Donate Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to modify the plugin's settings, including donation addresses and display configurations, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Bitcoin Donate Button <= 1.0 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c973dd9-cfa3-4f06-a25a-c2786e3dca4d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bitcoin-donate-button/trunk/btcbutton.php#L1"}, {"url": "https://plugins.trac.wordpress.org/browser/bitcoin-donate-button/tags/1.0/btcbutton.php#L1"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-01-27T21:49:55.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T14:34:39.824540Z", "id": "CVE-2026-1380", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T14:34:56.900Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1380", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T14:34:39.824540Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T14:34:46.569Z"}}], "cna": {"title": "Bitcoin Donate Button <= 1.0 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "lxicon", "product": "Bitcoin Donate Button", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-27T21:49:55.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c973dd9-cfa3-4f06-a25a-c2786e3dca4d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bitcoin-donate-button/trunk/btcbutton.php#L1"}, {"url": "https://plugins.trac.wordpress.org/browser/bitcoin-donate-button/tags/1.0/btcbutton.php#L1"}], "descriptions": [{"lang": "en", "value": "The Bitcoin Donate Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to modify the plugin's settings, including donation addresses and display configurations, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-28T11:23:39.083Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1380", "state": "PUBLISHED", "dateUpdated": "2026-01-28T14:34:56.900Z", "dateReserved": "2026-01-23T18:34:44.736Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-28T11:23:39.083Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Bitcoin Donate Button", "vendor": "lxicon", "versions": [{"lessThanOrEqual": "1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Bitcoin Donate Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to modify the plugin's settings, including donation addresses and display configurations, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Bitcoin Donate Button para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.0, inclusive. Esto se debe a la falta o validaci\u00f3n incorrecta de nonce en la p\u00e1gina de configuraci\u00f3n. Esto hace posible que atacantes no autenticados modifiquen la configuraci\u00f3n del plugin, incluyendo direcciones de donaci\u00f3n y configuraciones de visualizaci\u00f3n, a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-1380", "lastModified": "2026-06-17T10:15:41.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1380", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T14:34:39.824540Z", "version": "2.0.3"}}]}, "published": "2026-01-28T12:15:52.887", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bitcoin-donate-button/tags/1.0/btcbutton.php#L1"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bitcoin-donate-button/trunk/btcbutton.php#L1"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c973dd9-cfa3-4f06-a25a-c2786e3dca4d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T18:58:20.311825+00:00", "value": {"mitigation_remediation": ["Upgrade the Bitcoin Donate Button plugin to the latest available version that implements proper nonce checks for settings updates.", "If an upgrade cannot be applied immediately, add a server\u2011side or WordPress\u2011level filter that requires a valid nonce or referer check for requests targeting the settings endpoint, thereby preventing unauthenticated CSRF requests.", "Restrict the ability to modify plugin settings to a small set of trusted administrators and enable multi\u2011factor authentication for admin accounts to reduce the likelihood of successful social\u2011engineering attempts."], "summary": {"action": "Patch Now", "impact": "Unauthorized Settings Modification via CSRF"}, "threat_synthesis": {"affected_systems": "All installations of the Bitcoin Donate Button plugin up to and including version 1.0 from the vendor lxicon are affected. The vulnerability is present in every version up to the 1.0 release; no later versions are documented as affected.", "description_and_impact": "The Bitcoin Donate Button plugin for WordPress has a Cross\u2011Site Request Forgery flaw caused by missing or incorrect nonce validation on its settings page. An attacker who can trick a site administrator into clicking a crafted link can forge a request that alters the plugin\u2019s configuration, such as changing donation addresses or display options. This compromises the integrity of the donation process and can lead to financial loss by redirecting funds to attacker\u2011controlled addresses.", "risk_and_exploitability": "The CVSS base score is 4.3, indicating a moderate severity. The EPSS score is less than 1\u202f%, implying a low likelihood of exploitation at the present time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely local with a need for the administrator to click a malicious link; the attacker does not need to be authenticated but requires social engineering of an admin. The risk is moderate, with potential for financial damage if an attacker can reconfigure payment addresses."}}}}, "created": "2026-01-29T09:18:06.316812+00:00", "updated": "2026-04-15T19:00:12.310581+00:00", "vendors": ["lxicon", "lxicon$PRODUCT$bitcoin_donate_button", "wordpress", "wordpress$PRODUCT$wordpress"]}