CVE-2026-66602

HighCVSS 8.8

Published: 18/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

CSRF vulnerability in HashBar – WordPress Notification Bar plugin. Allows an attacker to perform unauthorized actions on behalf of a logged-in user.

Risk Assessment

An attacker can exploit CSRF to change plugin settings or perform other actions without admin consent, potentially compromising site integrity.

Recommendation

Update HashBar plugin to the latest patched version. Additionally, use CSRF tokens in forms.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.