Executive brief
WP AutoBuzz, a WordPress plugin used for content automation, contains a security flaw that allows attackers to trick site administrators into making unintended changes. By convincing an administrator to click a malicious link, an attacker can remotely modify the plugin's settings or inject harmful scripts into the website. This could lead to unauthorized website modifications or the redirection of visitors to malicious sites.
Technical details
The WP AutoBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on a settings-update function. An unauthenticated attacker can exploit this by tricking a site administrator into performing an action, such as clicking a link, which triggers a forged request to the vulnerable site. Because the plugin uses the update_option function to save unsanitized values directly, it bypasses WordPress's DISALLOW_UNFILTERED_HTML protection. This allows for the injection of malicious web scripts (Stored XSS) and unauthorized configuration changes. The vulnerability is present in all versions up to and including 1.1.1.
Affected products
- WP AutoBuzz WP AutoBuzz Up to, and including, 1.1.1
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-autobuzz/tags/1.1.1/wp-autobuzz.php
- https://plugins.trac.wordpress.org/browser/wp-autobuzz/tags/1.1.1/wp-autobuzz.php
- https://plugins.trac.wordpress.org/browser/wp-autobuzz/tags/1.1.1/wp-autobuzz.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/481dc27b-0d64-49cc-8d67-50fa53636398?source=cve