CVE-2026-7614

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the OPH_options function. This makes it possible for unauthenticated attackers to update the plugin's configuration settings without authorization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
mkhfrOld Posts Highlighter<= 1.0.3

References

Timeline

Published
May 27, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-761429.3Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unautheCVE-2026-761437.3A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login reqCVE-2026-761441.8An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacCVE-2026-761457.5An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force CVE-2026-761468.4An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to exeCVE-2026-761475.9A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of GeCVE-2026-761488.4CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.CVE-2026-761494.6CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.CVE-2026-76154.3The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is dueCVE-2026-761506.5Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allCVE-2026-761514.6Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 throughCVE-2026-761526.5Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms a