CVE-2026-8424
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Remove Yellow BGBOX plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. Missing nonce validation on the 'rybb_api_settings' page allows unauthenticated attackers to reset plugin settings via a forged request, provided they trick a site administrator into clicking a link.
Risk Assessment
An attacker can alter plugin settings without administrator consent, potentially causing unexpected site behavior or loss of configuration data.
Recommendation
Update the plugin to the latest version that includes a CSRF fix. If unavailable, consider temporarily disabling the plugin.
Original NVD description (English source)
The Remove Yellow BGBOX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'rybb_api_settings' page. This makes it possible for unauthenticated attackers to reset the plugin's stored settings by overwriting its configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.