---
id: "CVE-2026-124251"
page: "https://infrastack.ai/live/CVE-2026-124251"
kind: "vulnerability"
aliases: ["CVE-2026-124251"]
title: "WPIDE WordPress plugin: CSRF lets attackers trigger actions as admins"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wpide", "fixed": ["3.6.5"], "affected": "<= 3.6.4", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wpide"]
not_affected_if: ["no-logged-in-admin-browsing", "plugin-not-installed"]
published_at: "2026-11-10T17:17:25+00:00"
first_seen_at: "2026-11-10T17:22:40+00:00"
updated_at: "2026-11-10T17:26:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124251", "first_seen_at": "2026-11-10T17:22:40+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/plugin/wpide/vulnerabilities", "first_seen_at": "2026-11-10T17:26:15+00:00", "cites": ["https://patchstack.com/database/wordpress/plugin/wpide/vulnerabilities", "https://api.wordpress.org/plugins/info/1.0/wpide.json"]}]
exploit_sources: []
---

# WPIDE WordPress plugin: CSRF lets attackers trigger actions as admins

Link for people: https://infrastack.ai/live/CVE-2026-124251 (this .md is for agents)

WPIDE – File Manager & Code Editor, a WordPress plugin, has a cross-site request forgery flaw in versions through 3.6.4. An attacker can trick a logged-in user's browser into sending requests to the plugin that the user did not intend.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wpide affected <= 3.6.4 fixed 3.6.5

## How to check

- Run `wp plugin get wpide --field=version` or look under Plugins in WordPress admin; 3.6.4 or lower is in the affected range.
- Update to 3.6.5 (`wp plugin update wpide`) and confirm the version afterwards.
- The sources do not say which plugin actions the forged requests can reach; the plugin offers file editing, file upload/delete and snippets to admins, so treat it as admin-level impact.

## Fix

Update WPIDE to 3.6.5 (current release on wordpress.org; first version above the affected range <=3.6.4)

## Timeline

- 2026-11-10T17:22:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124251
- 2026-11-10T17:26:15+00:00 analyst https://patchstack.com/database/wordpress/plugin/wpide/vulnerabilities — CVE says <=3.6.4 affected; wordpress.org shows 3.6.5 current (2026-11-08). Changelog: 3.6.4 'enforced request verification across all admin pages' (reported by Greg Otto), 3.6.5 adds body-type refusal. Odd that 3.6.4 is listed affected while its changelog is the CSRF fix; fixed version inferred as 3.6.5, not stated by CVE/Patchstack. Specific exposed actions not stated by any source (Patchstack/NVD entry for this CVE not readable). Earlier CVE-2026-57766 (<=3.5.6, fixed 3.5.7) is a separate CSRF. Not marked verified.

## Documents

- [advisory] Patchstack: WPIDE vulnerability history (CSRF <= 3.6.4) https://patchstack.com/database/wordpress/plugin/wpide/vulnerabilities
- [fix] WPIDE plugin info and changelog (wordpress.org) https://api.wordpress.org/plugins/info/1.0/wpide.json

## From the sources

Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.This issue affects WPIDE – File Manager & Code Editor: from n/a through 3.6.4.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_