CVE-2026-6294 Details
Description
The Google PageRank Display plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4. This is due to missing nonce validation in the gpdisplay_option() function, which handles the plugin settings page. The settings form does not include a wp_nonce_field(), and the form handler does not call check_admin_referer() or wp_verify_nonce() before processing the POST request. This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a crafted request that changes the plugin's settings (stored via update_option()), such as the display style used to render the PageRank badge.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Google PageRank Display plugin for WordPress, affecting versions through 1.4. The issue arises from inadequate nonce validation in the 'gpdisplay_option()' function, which manages the plugin's settings page. The absence of a 'wp_nonce_field()' in the settings form, coupled with the form handler's failure to invoke 'check_admin_referer()' or 'wp_verify_nonce()' before processing POST requests, enables unauthenticated attackers to manipulate a logged-in administrator into submitting a forged request. This could result in unauthorized changes to the plugin's settings, such as the display style of the PageRank badge.
No known patch is available for this vulnerability. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 22, 2026CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.trac.wordpress.org/browser/google-pagerank-display/tags/1.4/gpdisplay.php#L32 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/google-pagerank-display/tags/1.4/gpdisplay.php#L56 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/google-pagerank-display/trunk/gpdisplay.php#L32 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/google-pagerank-display/trunk/gpdisplay.php#L56 | [email protected] | Broken LinkSource CodeVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/e39ebe27-7780-48b6-8dca-7da7a78fce69?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Google PageRank Display | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |