CVE-2026-8708

Name of the Vulnerable Software and Affected Versions Genzel breadcrumbs versions prior to 1.3

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation in the options page() function. Unauthenticated attackers can exploit this to modify the breadcrumb configuration, including templates, delimiters, home labels, home URIs, and breadcrumb rules, by inducing a site administrator to click a malicious link.

Recommendations Update the plugin to a version later than 1.2. As a temporary mitigation, restrict access to the options page() function.