Executive brief
The Quran Translations plugin for WordPress, which provides translation and media playlist features, contains a security flaw that allows unauthorized changes to its settings. By tricking a site administrator into clicking a malicious link, an attacker can remotely modify plugin options such as display settings for PDFs, podcasts, and media players. This could lead to unauthorized changes in how content is presented to site visitors.
Technical details
The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation in the quran_playlist_options() function. This function handles the plugin's settings page and processes POST requests to update options via update_option() without verifying a security nonce using wp_verify_nonce() or check_admin_referer(). An unauthenticated attacker can exploit this by inducing a logged-in administrator to submit a crafted request, typically via social engineering or a malicious link. Successful exploitation allows the attacker to toggle plugin display options, including PDF, RSS, podcast, and media player links, as well as playlist titles and codes. As of the advisory date, the vulnerability affects all versions up to and including 1.7.
Affected products
- edckwt Quran Translations <= 1.7
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
References
- https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/tags/1.7/playlist.php
- https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/tags/1.7/playlist.php
- https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/trunk/playlist.php
- https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/trunk/playlist.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e30379bf-0ea1-4443-81bb-4337a0311ed3?source=cve