CVE-2026-1087

Name of the Vulnerable Software and Affected Versions The Guardian News Feed plugin for WordPress versions up to and including 1.2

Description The plugin is susceptible to Cross-Site Request Forgery due to a lack of nonce validation when updating settings. This allows attackers to modify the plugin’s settings, including the Guardian API key, by deceiving a site administrator into performing an action. The attack requires the attacker to trick an administrator into clicking a malicious link.

Recommendations Update The Guardian News Feed plugin to a version newer than 1.2.