WordPress WP Editor Plugin CSRF Allows Arbitrary Code Execution

The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Editor plugin for WordPress contains a critical Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.2.9.2. The flaw exists in the 'add_plugins_page' and 'add_themes_page' functions, which fail to verify nonce tokens before processing requests to modify plugin and theme files. This means an unauthenticated attacker can craft a malicious webpage or email that, when clicked by a WordPress administrator, silently executes requests to overwrite arbitrary PHP files with attacker-controlled code. Since WordPress administrators typically have broad system access, successful exploitation grants attackers remote code execution capabilities on the affected server. Any organization using this plugin—particularly small to mid-sized businesses and WordPress agencies managing multiple sites—faces significant risk of site compromise, data theft, and lateral movement into their infrastructure.

Casky.ai's 301 mapped security skills leverage Claude's extended reasoning to detect the attack chain behind this CSRF vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify suspicious patterns including: unauthenticated requests to wp-admin endpoints modifying plugin/theme files without valid nonce parameters, unusual POST requests originating from external domains targeting administrative functions, and file write operations to wp-content directories lacking proper CSRF token validation. The platform's skills would surface indicators such as missing or predictable nonce values, absence of referer header validation, and direct file overwrites in plugin or theme directories—each a hallmark of CSRF exploitation. Security teams would see findings correlating social engineering attempts (phishing emails with embedded links) with subsequent unauthorized code modifications, enabling them to detect and block attacks before administrators execute the forged requests.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-3772.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-3772

Casky has 301 skills that investigate the attack patterns behind CVE-2026-3772. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn