Executive brief
The BirdSeed plugin for WordPress, which integrates the BirdSeed engagement platform into websites, is vulnerable to a security flaw that allows attackers to change the plugin's settings. By tricking a site administrator into clicking a malicious link, an attacker can modify the BirdSeed token used by the site. This could lead to a disruption of the engagement services or the redirection of customer interactions to an account controlled by the attacker.
Technical details
The BirdSeed plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation in the birdseed_plugin_settings_page() function. The function processes the 'birdseed_token' GET parameter and updates the database using the update_option() function without verifying a security nonce. An unauthenticated attacker can exploit this by crafting a malicious request and social engineering a site administrator into executing it (e.g., via a phishing link). Successful exploitation allows the attacker to overwrite the 'birdseed_token' configuration setting. This vulnerability affects all versions of the plugin up to and including 2.2.0.
Affected products
- BirdSeed BirdSeed up to, and including, 2.2.0
Timeline
- 2026-06-02: disclosed
- 2026-06-02: advisory
References
- https://plugins.trac.wordpress.org/browser/birdseed/tags/2.2.0/birdseed.php
- https://plugins.trac.wordpress.org/browser/birdseed/tags/2.2.0/birdseed.php
- https://plugins.trac.wordpress.org/browser/birdseed/trunk/birdseed.php
- https://plugins.trac.wordpress.org/browser/birdseed/trunk/birdseed.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/236f5a78-435a-48d1-9dd7-c42a2155cb88?source=cve