ABILITIES BRIDGE · CVE-2026-122003 · Package
NO FIX YET · SEE WHAT TO DO
The Abilities Bridge WordPress plugin before 1.4.2 accepts REST API requests from a logged-in administrator's session without checking a nonce. An attacker who tricks an administrator into opening a crafted page can make the browser run any REST API action, including creating a new administrator account.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any WordPress site running the Abilities Bridge plugin before 1.4.2 is exposed, especially sites where administrators browse the web while logged in. Sites without this plugin are not affected. The attack needs an administrator to open a crafted page while logged in, so limiting admin browsing sessions reduces risk until the update is applied.
Not affected if plugin-not-installed, version-1.4.2-or-later
Who cares abilities-bridge, wordpress, wordpress-plugin
wp plugin get abilities-bridge --field=version.1.4.2.1.4.2 or later.The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and taking over the site, by tricking them into opening a crafted page (CSRF).
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.