CVE-2026-24596

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24596", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:32:12.343Z", "datePublished": "2026-01-23T14:29:02.365Z", "dateUpdated": "2026-04-28T16:14:49.801Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "related-posts-thumbnails", "product": "Related Posts Thumbnails Plugin for WordPress", "vendor": "marynixie", "versions": [{"changes": [{"at": "4.3.3", "status": "unaffected"}], "lessThanOrEqual": "4.3.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Carlos Ferreira | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:51.449Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request Forgery.<p>This issue affects Related Posts Thumbnails Plugin for WordPress: from n/a through <= 4.3.2.</p>"}], "value": "Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request Forgery.This issue affects Related Posts Thumbnails Plugin for WordPress: from n/a through <= 4.3.2."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:49.801Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/related-posts-thumbnails/vulnerability/wordpress-related-posts-thumbnails-plugin-for-wordpress-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}], "title": "WordPress Related Posts Thumbnails plugin for WordPress plugin <= 4.3.2 - Cross Site Request Forgery (CSRF) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T20:39:26.926618Z", "id": "CVE-2026-24596", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:39:00.575Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24596", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T20:39:26.926618Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:39:22.493Z"}}], "cna": {"title": "WordPress Related Posts Thumbnails plugin for WordPress plugin <= 4.3.2 - Cross Site Request Forgery (CSRF) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Carlos Ferreira | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "marynixie", "product": "Related Posts Thumbnails Plugin for WordPress", "versions": [{"status": "affected", "changes": [{"at": "4.3.3", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "4.3.2"}], "packageName": "related-posts-thumbnails", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:51.449Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/related-posts-thumbnails/vulnerability/wordpress-related-posts-thumbnails-plugin-for-wordpress-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request Forgery.This issue affects Related Posts Thumbnails Plugin for WordPress: from n/a through <= 4.3.2.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request Forgery.<p>This issue affects Related Posts Thumbnails Plugin for WordPress: from n/a through <= 4.3.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:06.657Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24596", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:39:00.575Z", "dateReserved": "2026-01-23T12:32:12.343Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:29:02.365Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "related-posts-thumbnails", "product": "Related Posts Thumbnails Plugin for WordPress", "vendor": "marynixie", "versions": [{"changes": [{"at": "4.3.3", "status": "unaffected"}], "lessThanOrEqual": "4.3.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request Forgery.This issue affects Related Posts Thumbnails Plugin for WordPress: from n/a through <= 4.3.2."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en el plugin marynixie Related Posts Thumbnails para WordPress related-posts-thumbnails permite la falsificaci\u00f3n de petici\u00f3n en sitios cruzados. Este problema afecta al plugin Related Posts Thumbnails para WordPress: desde n/a hasta &lt;= 4.3.1."}], "id": "CVE-2026-24596", "lastModified": "2026-06-17T10:23:18.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24596", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T20:39:26.926618Z", "version": "2.0.3"}}]}, "published": "2026-01-23T15:16:17.793", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/related-posts-thumbnails/vulnerability/wordpress-related-posts-thumbnails-plugin-for-wordpress-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T22:28:26.771956+00:00", "value": {"mitigation_remediation": ["Update the plugin to a version newer than 4.3.2 that contains the CSRF fix", "If no update is available, remove or disable the plugin to eliminate the risk", "Ensure that any remaining plugin state\u2011changing requests are protected by proper nonce validation and that the plugin enforces role\u2011based access control before processing such requests", "As a temporary measure, limit the plugin\u2019s pages to trusted roles only by using a role\u2011based access control plugin or custom code"], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Request Forgery (CSRF) enabling unauthorized actions within WordPress sites"}, "threat_synthesis": {"affected_systems": "Affected systems include any installation of the Related Posts Thumbnails Plugin for WordPress version 4.3.2 or earlier. The plugin is distributed by Marynixie and used by WordPress sites that have installed the plugin via the WordPress plugin repository or direct download. Any site running a vulnerable version is susceptible to CSRF attacks executed by an attacker\u2019s web page.", "description_and_impact": "The Related Posts Thumbnails Plugin for WordPress contains a Cross\u2011Site Request Forgery (CSRF) flaw that permits an attacker to trick a logged\u2011in user into performing unintended actions within the plugin. Because the plugin accepts state\u2011changing requests without adequate anti\u2011CSRF tokens, a malicious site can cause a user to submit requests that alter plugin settings or data. This vulnerability aligns with CWE-352 and can lead to unauthorized configuration changes or data manipulation.", "risk_and_exploitability": "The vulnerability's CVSS score of 4.3 indicates a medium risk, and the EPSS score of less than 1% suggests a very low current exploitation probability. It is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation at the time of analysis. Based on the description, it is inferred that attackers can exploit the flaw by luring a legitimate WordPress user who has administrative or editor privileges to visit a malicious URL that submits a forged request to the plugin's endpoints."}}}}, "created": "2026-01-26T11:53:09.602533+00:00", "updated": "2026-04-28T22:30:41.638677+00:00", "vendors": ["marynixie", "marynixie$PRODUCT$related_posts_thumbnails_plugin_for_wordpress", "wordpress", "wordpress$PRODUCT$wordpress"]}