CVE-2026-6401 Details
Description
The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.1.7. This is due to missing nonce verification on the plugin's settings update forms handled in bottom-bar-admin.php. None of the three settings forms (main settings, sharing services, restore defaults) include a wp_nonce_field(), and the server-side processing code never calls check_admin_referer() or any equivalent nonce validation before processing POST data and calling update_option(). This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a crafted request that updates plugin configuration options, such as changing the language, maximum post counts, or enabled sharing services.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Bottom Bar plugin for WordPress, affecting all versions up to and including 0.1.7. The vulnerability arises from a lack of nonce verification in the plugin's settings update forms, which are managed in the 'bottom-bar-admin.php' file. None of the three settings forms—main settings, sharing services, and restore defaults—include the necessary nonce fields. As a result, the server-side processing code does not validate nonce data before handling POST requests and updating plugin options. This flaw allows unauthenticated attackers to manipulate a logged-in administrator into sending a modified request that alters plugin settings, such as the language, maximum post counts, or active sharing services.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 20, 2026CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.trac.wordpress.org/browser/bottom-bar/tags/0.1.7/bottom-bar-admin.php#L16 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/bottom-bar/tags/0.1.7/bottom-bar-admin.php#L59 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/bottom-bar/trunk/bottom-bar-admin.php#L16 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/bottom-bar/trunk/bottom-bar-admin.php#L59 | [email protected] | Broken LinkSource CodeVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/db0715ed-a06e-4a68-b9c3-408887cae113?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Bottom Bar | <= 0.1.7 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | New CVE Received | [email protected] |