{"id":"CVE-2026-122003","kind":"vulnerability","aliases":["CVE-2026-122003"],"related":[],"title":"Abilities Bridge WordPress plugin: CSRF lets attackers take over admin accounts","description":"The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and taking over the site, by tricking them into opening a crafted page (CSRF).","summary":"The Abilities Bridge WordPress plugin before 1.4.2 accepts REST API requests from a logged-in administrator's session without checking a nonce. An attacker who tricks an administrator into opening a crafted page can make the browser run any REST API action, including creating a new administrator account.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Abilities Bridge","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["abilities-bridge","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-1.4.2-or-later"],"how_to_check":"- Check the installed version of the Abilities Bridge plugin in the WordPress admin under Plugins, or with `wp plugin get abilities-bridge --field=version`.\n- Confirm whether the installed version is below `1.4.2`.","fix":"- Abilities Bridge plugin: update to `1.4.2` or later.","status":"open","published_at":"2026-11-12T06:17:12+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","triaged_at":"2026-11-12T06:37:57+00:00","updated_at":"2026-11-12T06:37:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T06:37:57Z","model":"claude-haiku-5-5","output":{"fix":"- Abilities Bridge plugin: update to `1.4.2` or later.","reach":"internet","title":"Abilities Bridge WordPress plugin: CSRF lets attackers take over admin accounts","impact":"high","summary":"The Abilities Bridge WordPress plugin before 1.4.2 accepts REST API requests from a logged-in administrator's session without checking a nonce. An attacker who tricks an administrator into opening a crafted page can make the browser run any REST API action, including creating a new administrator account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","abilities-bridge"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker creates an administrator account and takes over the site","analyst_note":"Confirm the affected version range and fixed version (1.4.2) against the plugin's WordPress.org page or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-122003.","how_to_check":"- Check the installed version of the Abilities Bridge plugin in the WordPress admin under Plugins, or with `wp plugin get abilities-bridge --field=version`.\n- Confirm whether the installed version is below `1.4.2`.","plain_action":"","product_name":"Abilities Bridge","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-1.4.2-or-later"],"who_is_affected":"Any WordPress site running the Abilities Bridge plugin before 1.4.2 is exposed, especially sites where administrators browse the web while logged in. Sites without this plugin are not affected. The attack needs an administrator to open a crafted page while logged in, so limiting admin browsing sessions reduces risk until the update is applied.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000794,"input_tokens":4567,"output_tokens":675,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122003':14A,17A '-2026':13A,16A '1.4.2':34B,83C 'abil':1A,21B,29B,78C 'abilities':18A 'abilities-bridg':20B 'accept':35B 'account':11A,76B,124C 'action':70B,118C 'admin':10A 'administr':44B,56B,75B,113C,123C 'allow':105C 'api':37B,69B,96C,117C 'attack':7A,52B,106C 'authent':93C 'bridg':2A,22B,30B,79C 'bridge':19A 'browser':65B 'check':48B 'cooki':104C 'craft':60B,136C 'creat':72B,120C 'csrf':5A,138C 'cve':12A,15A 'includ':71B,119C 'let':6A 'log':42B,101C,111C 'logged-in':41B,100C,110C 'make':63B,108C 'new':74B,122C 'nonc':50B,89C 'open':58B,134C 'packag':23B 'page':61B,137C 'perform':114C 'plugin':4A,27B,32B,81C 're':92C 're-authent':91C 'request':38B,97C 'requir':86C 'rest':36B,68B,95C,116C 'run':66B 'session':46B,103C 'site':129C 'take':8A,126C 'trick':54B,131C 'valid':88C 'without':47B 'wordpress':3A,24B,26B,31B,80C 'wordpress-plugin':25B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Abilities Bridge plugin before 1.4.2 is exposed, especially sites where administrators browse the web while logged in. Sites without this plugin are not affected. The attack needs an administrator to open a crafted page while logged in, so limiting admin browsing sessions reduces risk until the update is applied.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["abilitiesbridge","bridge"],"ptokens":["abilities","bridge"],"labels":["abilitiesbridge","high","package","vendor","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-122003':14A,17A '-2026':13A,16A 'abil':1A 'abilities':18A 'account':11A 'admin':10A 'attack':7A 'bridg':2A 'bridge':19A 'csrf':5A 'cve':12A,15A 'let':6A 'plugin':4A 'take':8A 'wordpress':3A","search_b":"'1.4.2':34B 'abil':21B,29B 'abilities-bridg':20B 'accept':35B 'account':76B 'action':70B 'administr':44B,56B,75B 'api':37B,69B 'attack':52B 'bridg':22B,30B 'browser':65B 'check':48B 'craft':60B 'creat':72B 'includ':71B 'log':42B 'logged-in':41B 'make':63B 'new':74B 'nonc':50B 'open':58B 'packag':23B 'page':61B 'plugin':27B,32B 'request':38B 'rest':36B,68B 'run':66B 'session':46B 'trick':54B 'without':47B 'wordpress':24B,26B,31B 'wordpress-plugin':25B","search_c":"'1.4.2':83C 'abil':78C 'account':124C 'action':118C 'administr':113C,123C 'allow':105C 'api':96C,117C 'attack':106C 'authent':93C 'bridg':79C 'cooki':104C 'craft':136C 'creat':120C 'csrf':138C 'includ':119C 'log':101C,111C 'logged-in':100C,110C 'make':108C 'new':122C 'nonc':89C 'open':134C 'page':137C 'perform':114C 'plugin':81C 're':92C 're-authent':91C 'request':97C 'requir':86C 'rest':95C,116C 'session':103C 'site':129C 'take':126C 'trick':131C 'valid':88C 'wordpress':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122003","severity":null,"published_at":"2026-11-12T06:17:12+00:00","modified_at":"2026-11-12T06:17:12+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","fetched_at":"2026-11-12T06:36:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}