CVE-2026-6401
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Missing nonce verification in Bottom Bar plugin for WordPress (up to 0.1.7) allows CSRF attacks, enabling unauthenticated attackers to update plugin configuration options.
Risk Assessment
Attackers can alter plugin configuration, potentially causing site malfunction or injection of malicious content.
Recommendation
Update the Bottom Bar plugin to the latest version and add wp_nonce_field() and check_admin_referer() to settings forms.
Original NVD description (English source)
The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.1.7. This is due to missing nonce verification on the plugin's settings update forms handled in bottom-bar-admin.php. None of the three settings forms (main settings, sharing services, restore defaults) include a wp_nonce_field(), and the server-side processing code never calls check_admin_referer() or any equivalent nonce validation before processing POST data and calling update_option(). This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a crafted request that updates plugin configuration options, such as changing the language, maximum post counts, or enabled sharing services.