CVE-2026-8939

Name of the Vulnerable Software and Affected Versions Search Simple Fields versions prior to 0.3

Description The plugin is subject to Cross-Site Request Forgery, a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation in the search simple fields options() function within the functions admin.php file. Unauthenticated attackers can exploit this to modify plugin settings, such as custom fields, media fields, the custom media function name, and the post types to be searched, by inducing a site administrator to click a malicious link.

Recommendations Update Search Simple Fields to a version later than 0.2.