CVE-2026-3903

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3903", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-10T18:58:10.198Z", "datePublished": "2026-03-11T07:36:25.132Z", "dateUpdated": "2026-04-08T17:06:55.839Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:55.839Z"}, "affected": [{"vendor": "modulards", "product": "Modular DS: Monitor, update, and backup multiple websites", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing nonce validation on the postConfirmOauth() function. This makes it possible for unauthenticated attackers to disconnect the plugin's OAuth/SSO connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Modular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/913a94ad-f425-4d24-9e23-7074ecfed8ad?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3441222/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2026-03-10T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T13:37:48.328029Z", "id": "CVE-2026-3903", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:39:07.783Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3903", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T13:37:48.328029Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:39:00.672Z"}}], "cna": {"title": "Modular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "modulards", "product": "Modular DS: Monitor, update, and backup multiple websites", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.5.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-10T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/913a94ad-f425-4d24-9e23-7074ecfed8ad?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3441222/"}], "descriptions": [{"lang": "en", "value": "The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing nonce validation on the postConfirmOauth() function. This makes it possible for unauthenticated attackers to disconnect the plugin's OAuth/SSO connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:55.839Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3903", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:55.839Z", "dateReserved": "2026-03-10T18:58:10.198Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-11T07:36:25.132Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Modular DS: Monitor, update, and backup multiple websites", "vendor": "modulards", "versions": [{"lessThanOrEqual": "2.5.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing nonce validation on the postConfirmOauth() function. This makes it possible for unauthenticated attackers to disconnect the plugin's OAuth/SSO connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Modular DS: Monitor, update, and backup multiple websites para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 2.5.1, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en la funci\u00f3n postConfirmOauth(). Esto hace posible que atacantes no autenticados desconecten la conexi\u00f3n OAuth/SSO del plugin mediante una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-3903", "lastModified": "2026-06-17T10:44:24.010", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3903", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T13:37:48.328029Z", "version": "2.0.3"}}]}, "published": "2026-03-11T08:16:04.087", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3441222/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/913a94ad-f425-4d24-9e23-7074ecfed8ad?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Modular DS: Monitor, update, and backup multiple websites", "source": "cna", "vendor": "modulards"}, "product": "modular_ds:_monitor,_update,_and_backup_multiple_websites", "vendor": "modulards"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T16:36:03.828367+00:00", "value": {"mitigation_remediation": ["Check the plugin\u2019s official website or WordPress repository for an updated version that addresses this issue.", "Install the latest plugin release (\u2265\u202f2.5.2) as soon as it is available.", "If an update is not yet released, temporarily disable the OAuth/SSO feature until the vulnerability is patched.", "Educate administrators to avoid clicking unknown links or visiting untrusted sites while logged into the WordPress admin.", "Consider implementing a web application firewall rule to block missing\u2011nonce CSRF requests to the postConfirmOauth endpoint."], "summary": {"action": "Apply Patch", "impact": "Unprivileged Modification of OAuth/SSO Connection"}, "threat_synthesis": {"affected_systems": "The affected product is modulards:Modular DS: Monitor, update, and backup multiple websites. All versions up to 2.5.1 are impacted; newer releases are presumed fixed. Administrators using the plugin at any of these versions are at risk.", "description_and_impact": "Modular DS: Monitor, update, and backup multiple websites is vulnerable to Cross\u2011Site Request Forgery in all versions up to and including 2.5.1. The vulnerability arises from missing nonce validation in the postConfirmOauth() function, which permits an attacker to forge a request that disconnects the plugin\u2019s OAuth/SSO connection when a site administrator submits it. This type of flaw allows an unauthenticated attacker to alter a privileged configuration setting, effectively disabling single sign\u2011on functionality without credentials. The weakness corresponds to CWE\u2011352.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a medium impact and an attack vector that requires interaction with a privileged user. The EPSS score is less than 1\u202f%, suggesting a low probability of automated exploitation today. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires an attacker to lure an administrator into unknowingly submitting a crafted request, such as clicking a malicious link or visiting a malicious page while logged in."}}}}, "created": "2026-03-12T10:06:16.214700+00:00", "updated": "2026-03-20T14:37:37.244691+00:00", "vendors": ["modulards", "modulards$PRODUCT$modular_ds:_monitor,_update,_and_backup_multiple_websites", "wordpress", "wordpress$PRODUCT$wordpress"]}