Executive brief
The WP Emoticon Rating plugin for WordPress, which allows users to rate content using emoticons, contains a security flaw that could allow an attacker to change site settings. By tricking a site administrator into clicking a malicious link, an attacker can silently modify plugin configurations or inject harmful scripts. This could lead to unauthorized changes to the website's behavior or the compromise of visitor data.
Technical details
The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on several functions within the admin interface (specifically in wp-emo-admin.php). An unauthenticated attacker can exploit this by crafting a malicious request and social engineering a site administrator into executing it (e.g., via a phishing link). Successful exploitation allows the attacker to modify plugin settings and potentially perform Stored Cross-Site Scripting (XSS) by injecting malicious scripts into those settings. All versions up to and including 1.0.1 are affected.
Affected products
- WordPress WP Emoticon Rating up to, and including, 1.0.1
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php
- https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php
- https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php
- https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php
- https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php
- https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a0b560-3f5a-4d09-9cc1-e22b2a19dfe6?source=cve