CVE-2026-1208: 
WordPress vulnerability analysis and mitigation

CVE-2026-1208 is a Cross-Site Request Forgery (CSRF) vulnerability in the Friendly Functions for Welcart plugin for WordPress, affecting all versions up to and including 1.2.5. The flaw stems from missing or incorrect nonce validation on the plugin's settings page, enabling unauthenticated attackers to modify plugin settings by tricking a logged-in administrator into clicking a malicious link. It was published on January 24, 2026, and assigned by Wordfence. The CVSS v3.1 base score is 4.3 (Medium) (Wordfence).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and exists because the plugin's settings page (ffw_function_settings.php) fails to properly validate WordPress nonces at lines 53 and 58, allowing state-changing requests to be submitted without proof of user intent. An attacker crafts a forged HTTP request targeting the plugin's settings endpoint and delivers it via a malicious link or page; when a site administrator visits the link while authenticated, the browser automatically submits the request with valid session credentials. No authentication or special privileges are required on the attacker's side — only the social engineering of an administrator is needed (Wordfence, WordPress Trac). A public PoC repository has been observed at https://github.com/SnailSploit/CVE-2026-1208.

Successful exploitation allows an unauthenticated attacker to modify the Friendly Functions for Welcart plugin's configuration settings on the affected WordPress site, impacting integrity. There is no direct confidentiality or availability impact (CVSS C:N/A:N), but unauthorized changes to e-commerce plugin settings could disrupt store functionality, alter payment or shipping configurations, or facilitate further attacks depending on what settings are exposed. The scope is limited to the affected plugin's settings and does not directly grant code execution or administrative access (Wordfence).

A public PoC has been published at https://github.com/SnailSploit/CVE-2026-1208, indicating the vulnerability has been weaponized to at least a proof-of-concept level. There is no confirmed evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.005% (0.000050), reflecting a very low probability of exploitation in the near term. CVE-2026-1208 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Friendly Functions for Welcart plugin at version 1.2.5 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Construct an HTML form or URL that submits a POST request to the plugin's settings page endpoint (targeting ffw_function_settings.php) with attacker-controlled parameter values and no valid nonce.
3. Deliver payload: Host the forged request on an attacker-controlled page or embed it in an email, forum post, or other medium likely to be visited by a site administrator while authenticated.
4. Trigger execution: When the administrator clicks the link or visits the page, their browser automatically submits the forged request with their active session cookies, causing the plugin settings to be updated with the attacker's values.
5. Achieve objective: Depending on the plugin settings exposed, the attacker may alter e-commerce configurations (e.g., payment, shipping, or display settings) to disrupt store operations or facilitate further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST requests to the plugin settings page (/wp-admin/admin.php or similar) from unusual referrer origins or with missing/invalid nonce fields.
• Application: Unexpected or unauthorized changes to Friendly Functions for Welcart plugin settings in the WordPress admin panel, particularly if no administrator recalls making such changes.
• Network: Referrer headers in server logs pointing to external or unknown domains for requests that modify plugin settings.

Users should update the Friendly Functions for Welcart plugin to version 1.2.6 or later, which addresses the missing nonce validation on the settings page. The fix is documented in the WordPress plugin changeset at https://plugins.trac.wordpress.org/changeset/3445305/. As a temporary workaround, administrators can restrict access to the WordPress admin panel by IP address or disable the plugin until the update is applied (Wordfence, WordPress Trac).

Wordfence, which discovered and reported the vulnerability, published a threat intelligence entry detailing the issue. Coverage has been limited to automated vulnerability aggregators and security databases, with no notable independent researcher commentary or significant media coverage identified at this time.