Junglewise Threat Intelligence

CVE-2026-7047: Frontend User Notes CSRF in funp_ajax_modify_notes

CVE-2026-7047 · Severity: medium · CVSS 4.3 · Published 2026-06-06

Executive brief

The Frontend User Notes plugin for WordPress, which allows users to manage personal notes on a website, contains a security flaw that could allow an attacker to modify a user's notes. By tricking a logged-in user or administrator into clicking a malicious link, an attacker can silently overwrite the victim's note content. This could lead to the loss of important personal information or the unauthorized alteration of user-stored data.

Technical details

The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'funp_ajax_modify_notes' function. An unauthenticated attacker can exploit this by inducing a logged-in user (including administrators) to visit a malicious page or click a link, which triggers a forged request to 'wp_update_post()'. While the vulnerability allows for unauthorized modification of note content, the impact is restricted by ownership enforcement: an attacker can only modify notes belonging to the specific victim who was tricked, as the plugin validates the note's '_funp_single_user_id' meta against the current session's user ID. The issue is present in all versions up to 2.1.1.

Affected products

  • Frontend User Notes Frontend User Notes up to, and including, 2.1.1

Timeline

  • 2026-06-06: disclosed: CVE published by Wordfence/NVD

References