CVE-2026-57690
MediumCVSS 4.3Summary
The Werkstatt plugin version 4.7.2 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated administrator.
Risk Assessment
The risk involves an attacker being able to execute unauthorized administrative operations, such as changing plugin settings or injecting malicious content, without the victim's knowledge.
Recommendation
It is recommended to immediately update the Werkstatt plugin to the latest available version that addresses this vulnerability. Also consider implementing CSRF protection mechanisms such as synchronizer tokens.
Other vulnerabilities in Werkstatt
See all- CVE-2026-57689Medium
The Werkstatt plugin in versions 4.7.2 and earlier contains a broken access control vulnerability for subscribers. This allows users with the subscriber role to gain unauthorized access to functions or data.
- CVE-2026-27414High
The Werkstatt plugin for WordPress versions 4.8.3 and earlier contains a PHP Object Injection vulnerability via the contributor mechanism. This allows an attacker to inject malicious objects, potentially leading to remote code execution.
Original NVD description (English source)
Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions.