CVE-2026-66642

MediumCVSS 5.4/10Last modified Aug 12, 2026

Description

Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery.

This issue affects WP Umbrella: from 2.24.2 through 2.26.2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
WP UmbrellaWP Umbrella>= 2.24.2, <= 2.26.2

References

Timeline

Published
Aug 10, 2026
Last modified
Aug 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-666436.5Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.CVE-2026-666446.5Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.CVE-2026-666456.5Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.CVE-2026-666466.5Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.CVE-2026-666476.5Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.CVE-2026-666489.8Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.CVE-2026-666499.3Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.CVE-2026-66659.8The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM clieCVE-2026-666509.8Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.CVE-2026-666516.5Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured AccessCVE-2026-666525.4Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: CVE-2026-666538.1Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
CVE-2026-66642: Medium severity, CVSS 5.4 | Vulnix