{"id":"CVE-2026-125446","kind":"vulnerability","aliases":["CVE-2026-125446"],"related":[],"title":"Edwiser Bridge WordPress plugin: CSRF flaw lets attackers trigger actions","description":"Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request Forgery.This issue affects Edwiser Bridge: from n/a through 4.3.4.","summary":"Edwiser Bridge, a WordPress plugin that connects WooCommerce to learning management systems, has a cross-site request forgery flaw affecting versions through 4.3.4. An attacker can trick a logged-in administrator's browser into sending requests the plugin accepts without checking the request's origin.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"edwiser-bridge","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["edwiser-bridge","lms","other","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Edwiser Bridge plugin version in the WordPress admin plugins list, or in the `edwiser-bridge` plugin header.\n- Treat any version up to `4.3.4` as affected.","fix":"- Edwiser Bridge: unknown; the sources do not state a fixed version.","status":"open","published_at":"2026-11-11T13:17:21+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","triaged_at":"2026-11-11T13:29:08+00:00","updated_at":"2026-11-11T13:29:08+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T13:29:08Z","model":"claude-haiku-5-5","output":{"fix":"- Edwiser Bridge: unknown; the sources do not state a fixed version.","reach":"internet","title":"Edwiser Bridge WordPress plugin: CSRF flaw lets attackers trigger actions","impact":"medium","summary":"Edwiser Bridge, a WordPress plugin that connects WooCommerce to learning management systems, has a cross-site request forgery flaw affecting versions through 4.3.4. An attacker can trick a logged-in administrator's browser into sending requests the plugin accepts without checking the request's origin.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","edwiser-bridge","woocommerce","lms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker performs plugin actions as a logged-in administrator via forged requests.","analyst_note":"Confirm the fixed version and the specific actions exposed to CSRF from the vendor advisory or the Wordfence/WPScan entry for CVE-2026-125446.","how_to_check":"- Check the installed Edwiser Bridge plugin version in the WordPress admin plugins list, or in the `edwiser-bridge` plugin header.\n- Treat any version up to `4.3.4` as affected.","plain_action":"","product_name":"edwiser-bridge","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Edwiser Bridge WordPress plugin at version 4.3.4 or earlier are exposed. The risk depends on whether a logged-in administrator visits attacker-controlled pages while signed in; sites without the plugin are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000776,"input_tokens":4562,"output_tokens":639,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125446':13A,16A '-2026':12A,15A '4.3.4':50B,100C 'accept':67B 'action':10A 'administr':59B 'affect':47B,94C 'allow':88C 'attack':8A,52B 'bridg':2A,22B,28B,84C,87C,96C 'bridge':19A 'browser':61B 'check':69B 'connect':33B 'cross':42B,75C,89C 'cross-sit':41B,74C 'csrf':5A,79C 'cve':11A,14A 'edwis':1A,21B,27B,83C,86C,95C 'edwiser':18A 'edwiser-bridg':20B,85C 'edwiser-bridge':17A 'flaw':6A,46B 'forgeri':45B,78C 'forgery.this':92C 'issu':93C 'learn':36B 'let':7A 'lms':23B 'log':57B 'logged-in':56B 'manag':37B 'n/a':98C 'origin':73B 'plugin':4A,31B,66B 'request':44B,64B,71B,77C,91C 'send':63B 'site':43B,76C,90C 'system':38B 'trick':54B 'trigger':9A 'version':48B 'vulner':80C 'wisdmlab':82C 'without':68B 'woocommerc':25B,34B 'wordpress':3A,26B,30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Edwiser Bridge WordPress plugin at version 4.3.4 or earlier are exposed. The risk depends on whether a logged-in administrator visits attacker-controlled pages while signed in; sites without the plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["edwiserbridge"],"ptokens":["bridge","edwiser"],"labels":["edwiserbridge","high","lms","other","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-125446':13A,16A '-2026':12A,15A 'action':10A 'attack':8A 'bridg':2A 'bridge':19A 'csrf':5A 'cve':11A,14A 'edwis':1A 'edwiser':18A 'edwiser-bridge':17A 'flaw':6A 'let':7A 'plugin':4A 'trigger':9A 'wordpress':3A","search_b":"'4.3.4':50B 'accept':67B 'administr':59B 'affect':47B 'attack':52B 'bridg':22B,28B 'browser':61B 'check':69B 'connect':33B 'cross':42B 'cross-sit':41B 'edwis':21B,27B 'edwiser-bridg':20B 'flaw':46B 'forgeri':45B 'learn':36B 'lms':23B 'log':57B 'logged-in':56B 'manag':37B 'origin':73B 'plugin':31B,66B 'request':44B,64B,71B 'send':63B 'site':43B 'system':38B 'trick':54B 'version':48B 'without':68B 'woocommerc':25B,34B 'wordpress':26B,30B","search_c":"'4.3.4':100C 'affect':94C 'allow':88C 'bridg':84C,87C,96C 'cross':75C,89C 'cross-sit':74C 'csrf':79C 'edwis':83C,86C,95C 'edwiser-bridg':85C 'forgeri':78C 'forgery.this':92C 'issu':93C 'n/a':98C 'request':77C,91C 'site':76C,90C 'vulner':80C 'wisdmlab':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125446","severity":null,"published_at":"2026-11-11T13:17:21+00:00","modified_at":"2026-11-11T13:17:21+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","fetched_at":"2026-11-11T13:27:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}