CVE-2026-8909

creationtimestamp| type| source ---|---|--- 2026-06-09 07:09:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mntnbehfup2e 2026-06-11 17:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mnzq3zestn2d...

CVE-2026-8909 WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action

The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to missing or incorrect nonce validation on the handleSaveGeneralSettings function. This makes it possible for unauthenticated attackers to modify the plugin's...