CVE-2026-1208

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
mainichiweb	Friendly Functions for Welcart	<= 1.2.5

References

Timeline

Published: Jan 24, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-120807.3A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys c CVE-2026-1208037.1A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWi CVE-2026-1208047.5A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authe CVE-2026-1208054.3In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-CVE-2026-1208065.5A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a CVE-2026-1208076.6A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated inte CVE-2026-1208087.4An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connection CVE-2026-1208096.8A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time CVE-2026-120815.0The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unser CVE-2026-1208106.5An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending CVE-2026-1208115.9A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference CVE-2026-1208126.5An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Unco