CVE-2026-4002

Name of the Vulnerable Software and Affected Versions Petje.af versions prior to 2.1.9

Description The plugin is subject to Cross-Site Request Forgery, a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs because the ajax revoke token() function, which processes the 'petjeaf disconnect' AJAX action, fails to implement nonce validation. A nonce is a unique token used to ensure that a request was intentionally sent by the user. Consequently, unauthenticated attackers can force authenticated users to revoke OAuth2 tokens, delete user meta, and delete WordPress user accounts for those with the petjeaf member role by inducing them to click a malicious link or visit a compromised site.

Recommendations Update the plugin to a version newer than 2.1.8. As a temporary mitigation, restrict access to the ajax revoke token() function until the update is applied.