CVE-2026-4002

Published: Apr 15, 2026 Last Modified: Apr 15, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: none

Description

AI Translation Available

The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8. This is due to missing nonce validation in the ajax_revoke_token() function which handles the 'petjeaf_disconnect' AJAX action. The function performs destructive operations including revoking OAuth2 tokens, deleting user meta, and deleting WordPress user accounts (for users with the 'petjeaf_member' role) without verifying the request originated from a legitimate source. This makes it possible for unauthenticated attackers to force authenticated users to delete their Petje.af member user accounts via a forged request granted the victim clicks on a link or visits a malicious site.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0002
Percentile
0,0th
Updated

EPSS Score Trend (Last 2 Days)

352

Cross-Site Request Forgery (CSRF)

Stable
Abstraction: Compound Structure: Composite
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability Non-Repudiation Access Control
Potential Impacts:
Gain Privileges Or Assume Identity Bypass Protection Mechanism Read Application Data Modify Application Data Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: Web Based, Web Server
Likelihood of Exploit: Medium
View CWE Details
https://plugins.trac.wordpress.org/browser/petje-af/tags/2.…
https://plugins.trac.wordpress.org/browser/petje-af/tags/2.1.8/includes/class-p…
https://plugins.trac.wordpress.org/browser/petje-af/tags/2.…
https://plugins.trac.wordpress.org/browser/petje-af/tags/2.1.8/includes/class-p…
https://plugins.trac.wordpress.org/browser/petje-af/tags/2.…
https://plugins.trac.wordpress.org/browser/petje-af/tags/2.1.8/includes/class-p…
https://plugins.trac.wordpress.org/browser/petje-af/trunk/i…
https://plugins.trac.wordpress.org/browser/petje-af/trunk/includes/class-petje-…
https://plugins.trac.wordpress.org/browser/petje-af/trunk/i…
https://plugins.trac.wordpress.org/browser/petje-af/trunk/includes/class-petje-…
https://plugins.trac.wordpress.org/browser/petje-af/trunk/i…
https://plugins.trac.wordpress.org/browser/petje-af/trunk/includes/class-petje-…
https://www.wordfence.com/threat-intel/vulnerabilities/id/2…
https://www.wordfence.com/threat-intel/vulnerabilities/id/28a071ac-37ee-4fb9-b8…