CVE-2026-7047

Name of the Vulnerable Software and Affected Versions Frontend User Notes versions prior to 2.1.2

Description The plugin is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a logged-in user into executing unwanted actions. This occurs due to missing or incorrect nonce validation in the funp ajax modify notes() function. Unauthenticated attackers can deceive a logged-in user or administrator into visiting a malicious page, leading to the unauthorized overwriting of the victim's own note content via a forged request to wp update post(). Because the system compares the funp single user id meta value against the current session ID, the impact is limited to modifying notes owned by the tricked user and cannot be used to alter notes of other users.

Recommendations Update to a version later than 2.1.1. As a temporary workaround, restrict access to the funp ajax modify notes() function to minimize the risk of exploitation.