CVE-2026-0572: 
WordPress vulnerability analysis and mitigation

CVE-2026-0572 is a Missing Authorization vulnerability in the WebPurify Profanity Filter plugin for WordPress that allows unauthenticated attackers to modify plugin settings. The flaw exists in all versions up to and including 4.0.2, due to a missing capability check on the webpurify_save_options function. It was published on February 4, 2026, with a patch available in version 4.0.3. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, EUVD).

The root cause is CWE-862 (Missing Authorization): the webpurify_save_options function in the plugin does not perform any capability or nonce check before processing and saving submitted options, allowing any unauthenticated HTTP request to alter plugin configuration. An attacker can send a crafted POST request directly to the WordPress admin-ajax or options handler endpoint that invokes this function, with no authentication or privilege required. The vulnerable code path is visible in the plugin's source at webpurifytextreplace-options.php (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to arbitrarily change the WebPurify Profanity Filter plugin's settings, which can undermine content moderation integrity on the affected WordPress site. Attackers could disable profanity filtering entirely, redirect API calls to a malicious endpoint, or otherwise manipulate filter configurations to allow harmful content to appear on the site. The CVSS assessment reflects low integrity and low availability impact with no confidentiality impact, meaning sensitive data is not directly exposed, but site functionality and content quality can be degraded (Wordfence, EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-0572 as of the available data. The EPSS score is approximately 0.066%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low barrier to exploitation (no authentication required, network-accessible) does increase theoretical risk for unpatched sites (Wordfence).

1. Reconnaissance: Identify WordPress sites using the WebPurify Profanity Filter plugin (versions ≤ 4.0.2) via passive scanning, WordPress plugin enumeration tools (e.g., WPScan), or by checking /wp-content/plugins/webpurifytextreplace/ for plugin presence.
2. Craft malicious request: Prepare an HTTP POST request targeting the WordPress admin-ajax endpoint or the options-saving handler that invokes webpurify_save_options, including desired plugin configuration parameters in the POST body.
3. Submit unauthenticated request: Send the crafted POST request without any authentication cookies or nonce tokens, exploiting the missing capability check to have the server accept and save the attacker-controlled settings.
4. Verify impact: Confirm that plugin settings have been changed (e.g., by observing that profanity filtering is disabled or that the API key/endpoint has been altered), achieving the attacker's objective of disrupting content moderation (Wordfence, WordPress Trac).

• Network: Unexpected POST requests to WordPress admin-ajax or options endpoints (e.g., wp-admin/admin-ajax.php or wp-admin/options.php) from unauthenticated or anonymous sources targeting WebPurify plugin actions.
• Logs: WordPress access logs showing POST requests to plugin option-saving endpoints without valid authentication sessions or nonce values; repeated requests from the same IP attempting to alter plugin settings.
• Application: Unexpected changes to WebPurify Profanity Filter plugin settings in the WordPress admin panel (e.g., API key replaced, filter mode changed, or plugin disabled) without corresponding admin activity in audit logs.

WordPress site administrators should update the WebPurify Profanity Filter plugin to version 4.0.3 or later, which introduces the missing capability check and resolves the vulnerability. If immediate patching is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin-ajax endpoint via web application firewall (WAF) rules to block unauthenticated POST requests targeting plugin option functions. Regularly auditing plugin settings for unexpected changes is also recommended as a compensating control (Wordfence, Wordfence Weekly Report).

Wordfence disclosed and reported the vulnerability as part of their weekly WordPress vulnerability intelligence report for the week of February 2–8, 2026, noting the missing authorization issue and the availability of a patch in version 4.0.3 (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.