Junglewise Threat Intelligence

CVE-2026-7614: Old Posts Highlighter CSRF in OPH_options function

CVE-2026-7614 · Severity: medium · CVSS 4.3 · Published 2026-05-27

Executive brief

The Old Posts Highlighter plugin for WordPress, which helps manage and highlight older content, contains a security flaw that allows unauthorized changes to its settings. By tricking a site administrator into clicking a malicious link, an attacker can remotely modify the plugin's configuration. This could lead to unauthorized changes in how content is displayed or managed on the website.

Technical details

The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the OPH_options function in OPH_admin.php. This vulnerability affects all versions up to and including 1.0.3. An unauthenticated attacker can exploit this by inducing a logged-in administrator to interact with a specially crafted link or page. Successful exploitation allows the attacker to update the plugin's configuration settings without authorization. The attack requires user interaction (UI:R) and is delivered over the network.

Affected products

  • Old Posts Highlighter Old Posts Highlighter Up to, and including, 1.0.3

Timeline

  • 2026-05-27: disclosed: Initial disclosure and NVD publication

References