CVE-2026-8911

Name of the Vulnerable Software and Affected Versions WP AutoBuzz versions prior to 1.1.2

Description This issue involves Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. The problem arises from missing or incorrect nonce validation—a security token used to verify that a request is legitimate—within a function. This allows unauthenticated attackers to update settings and inject malicious web scripts through forged requests, provided they can trick a site administrator into clicking a link. The flaw bypasses the DISALLOW UNFILTERED HTML protection because unsanitized values are written directly via the update option() function at the plugin level, bypassing standard WordPress post content handling.

Recommendations Update WP AutoBuzz to version 1.1.2 or later.