CVE-2026-1877

Name of the Vulnerable Software and Affected Versions Auto Post Scheduler plugin for WordPress versions prior to 1.85

Description The Auto Post Scheduler plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by a lack of nonce validation within the aps options page function. An unauthenticated attacker could potentially update settings and inject malicious web scripts by deceiving a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update the Auto Post Scheduler plugin to version 1.85 or later.