{"id":"CVE-2026-124251","kind":"vulnerability","aliases":["CVE-2026-124251"],"related":[],"title":"WPIDE WordPress plugin: CSRF lets attackers trigger actions as admins","description":"Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.This issue affects WPIDE – File Manager & Code Editor: from n/a through 3.6.4.","summary":"WPIDE – File Manager & Code Editor, a WordPress plugin, has a cross-site request forgery flaw in versions through 3.6.4. An attacker can trick a logged-in user's browser into sending requests to the plugin that the user did not intend.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wpide","fixed":["3.6.5"],"affected":"<= 3.6.4","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpide"],"not_affected_if":["no-logged-in-admin-browsing","plugin-not-installed"],"how_to_check":"- Run `wp plugin get wpide --field=version` or look under Plugins in WordPress admin; 3.6.4 or lower is in the affected range.\n- Update to 3.6.5 (`wp plugin update wpide`) and confirm the version afterwards.\n- The sources do not say which plugin actions the forged requests can reach; the plugin offers file editing, file upload/delete and snippets to admins, so treat it as admin-level impact.","fix":"Update WPIDE to 3.6.5 (current release on wordpress.org; first version above the affected range <=3.6.4)","status":"open","published_at":"2026-11-10T17:17:25+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","triaged_at":"2026-11-10T17:23:43+00:00","updated_at":"2026-11-10T17:26:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T17:23:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WPIDE WordPress plugin: CSRF lets attackers trigger actions as admins","impact":"medium","summary":"WPIDE – File Manager & Code Editor, a WordPress plugin, has a cross-site request forgery flaw in versions through 3.6.4. An attacker can trick a logged-in user's browser into sending requests to the plugin that the user did not intend.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpide","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"forged requests change plugin settings or files as a logged-in user","analyst_note":"Confirm the fixed version and which plugin actions are CSRF-exposed, using the NVD entry and the vendor's changelog for WPIDE.","how_to_check":"- Check the installed WPIDE plugin version in the WordPress admin under Plugins, or with `wp plugin get wpide --field=version`\n- Compare the result with the fixed version, which the sources do not state\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WPIDE – File Manager & Code Editor WordPress plugin at version 3.6.4 or earlier are in the affected range. The flaw needs a logged-in administrator to visit a malicious page, so sites that do not run the plugin can skip it. The sources do not say which actions the forged requests can reach.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000752,"input_tokens":4566,"output_tokens":591,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and which plugin actions are CSRF-exposed, using the NVD entry and the vendor's changelog for WPIDE.","search":"'-124251':13A,16A '-2026':12A,15A '3.6.4':43B,97C 'action':8A 'admin':10A 'affect':88C 'allow':82C 'attack':6A,45B 'browser':54B 'code':27B,79C,92C 'cross':35B,68C,83C 'cross-sit':34B,67C 'csrf':4A,72C 'cve':11A,14A 'editor':28B,80C,93C 'file':25B,77C,90C 'flaw':39B 'forgeri':38B,71C 'forgery.this':86C 'host':21B 'intend':66B 'issu':87C 'let':5A 'log':50B 'logged-in':49B 'manag':26B,78C,91C 'n/a':95C 'packag':18B 'plugin':3A,31B,60B 'request':37B,57B,70C,85C 'self':20B 'self-host':19B 'send':56B 'site':36B,69C,84C 'trick':47B 'trigger':7A 'user':52B,63B 'version':41B 'vulner':73C 'wordpress':2A,22B,30B 'wpide':1A,17A,23B,24B,76C,81C,89C 'xplodedthem':75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPIDE – File Manager & Code Editor WordPress plugin at version 3.6.4 or earlier are in the affected range. The flaw needs a logged-in administrator to visit a malicious page, so sites that do not run the plugin can skip it. The sources do not say which actions the forged requests can reach.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wpide"],"ptokens":["wpide"],"labels":["high","package","selfhosted","wordpress","wpide"],"campaign_type":null,"search_a":"'-124251':13A,16A '-2026':12A,15A 'action':8A 'admin':10A 'attack':6A 'csrf':4A 'cve':11A,14A 'let':5A 'plugin':3A 'trigger':7A 'wordpress':2A 'wpide':1A,17A","search_b":"'3.6.4':43B 'attack':45B 'browser':54B 'code':27B 'cross':35B 'cross-sit':34B 'editor':28B 'file':25B 'flaw':39B 'forgeri':38B 'host':21B 'intend':66B 'log':50B 'logged-in':49B 'manag':26B 'packag':18B 'plugin':31B,60B 'request':37B,57B 'self':20B 'self-host':19B 'send':56B 'site':36B 'trick':47B 'user':52B,63B 'version':41B 'wordpress':22B,30B 'wpide':23B,24B","search_c":"'3.6.4':97C 'affect':88C 'allow':82C 'code':79C,92C 'cross':68C,83C 'cross-sit':67C 'csrf':72C 'editor':80C,93C 'file':77C,90C 'forgeri':71C 'forgery.this':86C 'issu':87C 'manag':78C,91C 'n/a':95C 'request':70C,85C 'site':69C,84C 'vulner':73C 'wpide':76C,81C,89C 'xplodedthem':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124251","severity":null,"published_at":"2026-11-10T17:17:25+00:00","modified_at":"2026-11-10T17:17:25+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","fetched_at":"2026-11-10T17:22:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124251:2479","url":"https://api.wordpress.org/plugins/info/1.0/wpide.json","severity":null,"published_at":"2026-11-10T17:26:15+00:00","modified_at":"2026-11-10T17:26:15+00:00","first_seen_at":"2026-11-10T17:26:15+00:00","fetched_at":"2026-11-10T17:26:15+00:00","note":"CVE says <=3.6.4 affected; wordpress.org shows 3.6.5 current (2026-11-08). Changelog: 3.6.4 'enforced request verification across all admin pages' (reported by Greg Otto), 3.6.5 adds body-type refusal. Odd that 3.6.4 is listed affected while its changelog is the CSRF fix; fixed version inferred as 3.6.5, not stated by CVE/Patchstack. Specific exposed actions not stated by any source (Patchstack/NVD entry for this CVE not readable). Earlier CVE-2026-57766 (<=3.5.6, fixed 3.5.7) is a separate CSRF. Not marked verified.","cites":["https://api.wordpress.org/plugins/info/1.0/wpide.json","https://patchstack.com/database/wordpress/plugin/wpide/vulnerabilities"]}],"documents":[{"id":116650,"url":"https://api.wordpress.org/plugins/info/1.0/wpide.json","title":"WPIDE plugin info and changelog (wordpress.org)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":116651,"url":"https://patchstack.com/database/wordpress/plugin/wpide/vulnerabilities","title":"Patchstack: WPIDE vulnerability history (CSRF <= 3.6.4)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}