CVE-2026-4141
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Quran Translations plugin for WordPress up to version 1.7 is vulnerable to Cross-Site Request Forgery (CSRF). Missing nonce verification in the quran_playlist_options() function allows an unauthenticated attacker to modify plugin settings via a forged request, provided they trick an administrator into clicking a link.
Risk Assessment
An attacker can change plugin settings (e.g., display of PDF, RSS, podcast links), potentially leading to unauthorized changes in site functionality.
Recommendation
Immediately update the Quran Translations plugin to the latest available version that fixes this vulnerability.
Original NVD description (English source)
The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation in the quran_playlist_options() function that handles the plugin's settings page. The function processes POST requests to update plugin options via update_option() without any wp_nonce_field() in the form or wp_verify_nonce()/check_admin_referer() verification before processing. This makes it possible for unauthenticated attackers to modify plugin settings (toggling display options for PDF, RSS, podcast, media player links, playlist title, and playlist code) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.