CVE-2026-6701: 
WordPress vulnerability analysis and mitigation

CVE-2026-6701 is a Cross-Site Request Forgery (CSRF) vulnerability in the addfreespace plugin for WordPress, affecting all versions up to and including 0.1.3. The flaw stems from missing or incorrect nonce validation, enabling unauthenticated attackers to update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a crafted link. It was published on May 5, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), arising from the absence of proper WordPress nonce validation on one or more functions within the plugin. Specifically, vulnerable code has been identified at addfreespace.php lines 45 and 312, and addfreespace_functions.php lines 30, 59, and 83 in version 0.1.3. An attacker crafts a forged HTTP request targeting these unprotected functions; when an authenticated administrator visits a malicious page or clicks a crafted link, the browser automatically sends the request with the administrator's session credentials, allowing unauthorized actions to be performed without the administrator's knowledge (GitHub Advisory, Wordfence).

Successful exploitation allows an unauthenticated attacker to modify plugin settings and inject malicious web scripts (stored XSS via CSRF) into the WordPress site, potentially affecting site visitors. The integrity impact is limited to low per the CVSS scoring, with no direct confidentiality or availability impact. However, injected scripts could be leveraged for session hijacking, credential theft, or further compromise of site visitors depending on the nature of the injected content (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. Exploitation requires social engineering to trick a logged-in WordPress administrator into performing an action (e.g., clicking a malicious link), which limits the attack surface. The EPSS score is approximately 0.018% (0.022% per GitHub Advisory), placing it in the 6th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the addfreespace plugin version 0.1.3 or earlier, using tools such as WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Create an HTML page or link containing a forged form or AJAX request targeting the vulnerable addfreespace plugin functions (e.g., those at addfreespace.php L45/L312 or addfreespace_functions.php L30/L59/L83) with attacker-controlled parameter values, including a malicious script payload.
3. Social engineering: Deliver the crafted link or page to a WordPress site administrator via phishing email, forum post, or other means, inducing them to click the link while authenticated to their WordPress dashboard.
4. CSRF execution: The administrator's browser automatically submits the forged request with their valid session cookies, causing the plugin to update settings or inject the malicious script without nonce verification.
5. Achieve objective: The injected script is stored or executed within the WordPress site, potentially affecting site visitors or enabling further attacks such as session hijacking (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to admin-ajax.php or plugin-specific endpoints associated with addfreespace functions, originating from unusual referrers or external domains.
• File System: Unexpected modifications to addfreespace plugin configuration or database entries storing plugin settings, particularly if containing <script> tags or encoded JavaScript.
• Database: WordPress wp_options table entries related to the addfreespace plugin containing injected script content or altered configuration values not set by the administrator.
• Network: Outbound requests from site visitors' browsers to unknown third-party domains, potentially indicating injected script execution.

Site administrators should update the addfreespace WordPress plugin to a version released after 0.1.3, which includes proper nonce validation. A patch was made available on May 4–5, 2026. As an interim measure, administrators should disable the plugin until an update can be applied, and exercise caution with unsolicited links or emails. Educating administrators about phishing and social engineering tactics is also recommended to reduce the risk of CSRF exploitation (GitHub Advisory, Wordfence).

Wordfence reported this vulnerability as part of their weekly WordPress vulnerability intelligence reports for the weeks of May 4–10 and May 11–17, 2026, indicating routine tracking of the issue within the WordPress security community (Wordfence Weekly May 4, Wordfence Weekly May 11). No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure has been observed.