← Back

CVE-2026-1082

nvd nist
Published: Feb 7, 2026Modified: Feb 9, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: security@wordfence.com

Description

The TITLE ANIMATOR plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page form handler in `inc/settings-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (3)

Source: security@wordfence.com
Source: security@wordfence.com
Source: security@wordfence.com

Timeline (6)

2/7/2026
6 changes
New CVE Received - Reference
09:15 AM
- -
+ https://www.wordfence.com/threat-intel/vulnerabilities/id/98736b9d-3e0a-40c0-900a-fbbaaac07958?source=cve
New CVE Received - Reference
09:15 AM
- -
+ https://plugins.trac.wordpress.org/browser/title-animator/trunk/inc/settings-page.php#L5
New CVE Received - Reference
09:15 AM
- -
+ https://plugins.trac.wordpress.org/browser/title-animator/tags/1.0/inc/settings-page.php#L5
New CVE Received - CWE
09:15 AM
- -
+ CWE-352
New CVE Received - CVSS V3.1
09:15 AM
- -
+ AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
New CVE Received - Description
09:15 AM
- -
+ The TITLE ANIMATOR plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page form handler in `inc/settings-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.