Executive brief
The Laiser Tag plugin for WordPress, which helps automate content tagging, contains a security flaw that could allow an attacker to change the plugin's settings. By tricking a site administrator into clicking a malicious link, an attacker could modify sensitive information such as API keys, tag blacklists, and processing thresholds. This could lead to unauthorized changes in how the website categorizes content or disrupt integrated third-party services.
Technical details
The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the addOptionsPageFields function. This vulnerability exists in all versions up to and including 1.2.5. An unauthenticated attacker can exploit this by inducing a site administrator to perform an action, such as clicking a link, which triggers a forged request to the server. Successful exploitation allows the attacker to modify plugin configurations, including the API key, tag blacklist, relevance threshold, and batch size. The attack requires user interaction from an authenticated administrator but no prior authentication from the attacker.
Affected products
- WordPress Laiser Tag up to, and including, 1.2.5
Timeline
- 2026-06-02: disclosed
- 2026-06-02: advisory
References
- https://plugins.trac.wordpress.org/browser/laiser-tag/trunk/include/Tagging.php
- https://plugins.trac.wordpress.org/browser/laiser-tag/trunk/include/Tagging.php
- https://plugins.trac.wordpress.org/browser/laiser-tag/trunk/templates/adminOptionPage.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ed3aaa2a-8211-409c-8a75-1ac59e1d55e2?source=cve