CVE-2026-7616

Name of the Vulnerable Software and Affected Versions Zawgyi Embed versions prior to 2.1.2

Description The plugin is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation in the zawgyi adminpage() function. Unauthenticated attackers can modify the zawgyi forceCSS setting by submitting a forged POST request to the 'options-general.php?page=zawgyi embed' endpoint, provided they can induce a site administrator to click a malicious link.

Recommendations Update the plugin to version 2.1.2 or later. As a temporary mitigation, restrict access to the 'options-general.php?page=zawgyi embed' endpoint.