CVE-2026-7616 Details
Description
The Zawgyi Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the zawgyi_adminpage function. This makes it possible for unauthenticated attackers to update the plugin's zawgyi_forceCSS setting by submitting a forged POST request to options-general.php?page=zawgyi_embed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Zawgyi Embed plugin for WordPress, affecting all versions through 2.1.1. The issue arises from inadequate nonce validation in the 'zawgyi_adminpage' function, allowing unauthenticated attackers to manipulate the 'zawgyi_forceCSS' setting. Exploitation involves sending a forged POST request to 'options-general.php?page=zawgyi_embed', tricking a site administrator into clicking a link that activates the request.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.trac.wordpress.org/browser/zawgyi-embed/tags/2.1.1/adminpanel.php#L19 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/zawgyi-embed/tags/2.1.1/adminpanel.php#L22 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/zawgyi-embed/trunk/adminpanel.php#L19 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/zawgyi-embed/trunk/adminpanel.php#L22 | [email protected] | Broken LinkSource CodeVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/86a85e07-8359-441f-abb4-a1ca6083e6cd?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zawgyi Embed | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |