CVE-2026-1072: 
WordPress vulnerability analysis and mitigation

CVE-2026-1072 is a Cross-Site Request Forgery (CSRF) vulnerability in the Keybase.io Verification plugin for WordPress, affecting all versions up to and including 1.4.5. The flaw stems from missing nonce validation when updating plugin settings, allowing unauthenticated attackers to modify the Keybase verification text by tricking a site administrator into clicking a malicious link. It was published on February 18, 2026, with a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), arising from the plugin's failure to validate WordPress nonces before processing settings update requests. Because no authentication token is verified server-side, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator, causes the server to accept and apply the malicious settings change. No special privileges are required by the attacker; only user interaction from an administrator is needed to complete the attack (Red Hat CVE).

Successful exploitation allows an unauthenticated attacker to modify the Keybase verification text stored in the plugin's settings, resulting in a low-integrity impact with no confidentiality or availability consequences. The attack is limited in scope to the plugin's configuration data and does not enable remote code execution, data exfiltration, or lateral movement. The practical risk is primarily reputational — an attacker could alter site identity verification information displayed to visitors (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Keybase.io Verification plugin version 1.4.5 or earlier, using tools such as WPScan or by inspecting publicly visible plugin metadata.
2. Craft malicious request: Construct a forged HTTP POST request targeting the plugin's settings update endpoint (e.g., the WordPress admin-post or options handler), including the desired Keybase verification text as the payload, without any valid nonce.
3. Deliver the payload: Embed the forged request in a malicious link, image tag, or web page (e.g., via an <img> or <form> with auto-submit JavaScript) and socially engineer a logged-in site administrator into visiting or clicking it.
4. Settings modified: Upon the administrator's browser sending the forged request, the server processes it without nonce validation and updates the Keybase verification text to the attacker-controlled value (Red Hat CVE).

• Logs: WordPress access logs showing unexpected POST requests to the plugin's settings update endpoint originating from unusual referrers or external domains.
• File System / Database: Unexpected changes to the Keybase verification text value in the WordPress wp_options table (option name associated with the Keybase.io Verification plugin settings).
• Logs: WordPress admin audit logs (if enabled via a plugin) recording settings changes at unusual times or without a corresponding administrator login session.

WordPress site administrators should update the Keybase.io Verification plugin to a version beyond 1.4.5 that includes proper nonce validation, once a patched release is made available by the plugin author. In the interim, administrators can deactivate or remove the plugin to eliminate the attack surface. Additionally, enforcing strict Content Security Policy (CSP) headers and educating administrators about phishing and social engineering risks can reduce the likelihood of successful CSRF exploitation (Red Hat CVE).