CVE-2026-2410: 
WordPress vulnerability analysis and mitigation

CVE-2026-2410 is a Cross-Site Request Forgery (CSRF) vulnerability in the "Disable Admin Notices – Hide Dashboard Notifications" WordPress plugin, developed by ThemeIsle. It affects all versions up to and including 1.4.2, allowing unauthenticated attackers to add arbitrary URLs to the blocked redirects list by tricking a site administrator into clicking a malicious link. The vulnerability was published on February 25, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is missing nonce validation in the showPageContent() function within admin/pages/class-pages-edit-redirects.php (CWE-352: Cross-Site Request Forgery). Because no CSRF token is verified before processing form submissions, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator, causes the plugin to add attacker-controlled URLs to the blocked redirects list. Exploitation requires social engineering — the attacker must trick a logged-in site administrator into performing an action such as clicking a crafted link. The vulnerable code path is publicly visible in the plugin's Trac repository (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to manipulate the plugin's blocked redirects list by injecting arbitrary URLs, resulting in a low-integrity impact with no confidentiality or availability consequences. While the direct impact is limited, abuse of the blocked redirects list could interfere with legitimate site redirect behavior or be used as part of a broader attack chain targeting WordPress site functionality. The scope is unchanged, meaning the impact is confined to the affected WordPress installation (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-2410. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (an administrator must be tricked into clicking a malicious link), which significantly limits the attack surface (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the "Disable Admin Notices – Hide Dashboard Notifications" plugin at version 1.4.2 or earlier, using tools like WPScan or passive enumeration.
2. Craft malicious request: Construct a forged HTTP POST request targeting the plugin's redirect management page (handled by showPageContent() in class-pages-edit-redirects.php), including an attacker-controlled URL as the redirect entry parameter.
3. Deliver payload: Embed the forged request in a malicious link, image tag, or hidden form on an attacker-controlled page, then socially engineer a logged-in WordPress administrator into visiting that page or clicking the link.
4. Trigger CSRF: When the administrator's browser executes the forged request, the plugin processes it without nonce validation and adds the attacker-specified URL to the blocked redirects list.
5. Achieve objective: The manipulated redirects list may disrupt legitimate site redirect behavior or serve as a stepping stone in a broader attack (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST requests to the plugin's admin redirect management page (/wp-admin/admin.php?page=disable-admin-notices-redirects or similar) from unusual referrers or external origins.
• Database: Unexpected or unfamiliar URLs appearing in the plugin's blocked redirects list within the WordPress options table (wp_options).
• Network: Requests to the WordPress admin panel originating from external or unknown IP addresses, particularly with referrer headers pointing to non-site domains.

Users should update the "Disable Admin Notices – Hide Dashboard Notifications" plugin to a version beyond 1.4.2 that includes nonce validation in the showPageContent() function. The fix is available in the plugin's trunk as reflected in the changeset on WordPress Trac. As a general workaround, administrators should be cautious about clicking links from untrusted sources while logged into the WordPress dashboard, and consider using a web application firewall (WAF) to detect and block CSRF attempts (WordPress Trac Changeset, Wordfence).

The vulnerability was reported and assigned by Wordfence, which published the advisory on February 25, 2026. Coverage has been limited to automated vulnerability aggregators and security feeds, with no notable researcher commentary or significant media coverage identified beyond standard CVE tracking (Wordfence).