{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1082", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-16T20:37:32.569Z", "datePublished": "2026-02-07T08:26:39.384Z", "dateUpdated": "2026-04-08T17:10:40.917Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:40.917Z"}, "affected": [{"vendor": "arkapravamajumder", "product": "TITLE ANIMATOR", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The TITLE ANIMATOR plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page form handler in `inc/settings-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "TITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/98736b9d-3e0a-40c0-900a-fbbaaac07958?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/title-animator/trunk/inc/settings-page.php#L5"}, {"url": "https://plugins.trac.wordpress.org/browser/title-animator/tags/1.0/inc/settings-page.php#L5"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Afnaan"}], "timeline": [{"time": "2026-02-06T20:24:28.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:37:22.674062Z", "id": "CVE-2026-1082", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:45:57.951Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1082", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:37:22.674062Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:37:23.417Z"}}], "cna": {"title": "TITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Afnaan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "arkapravamajumder", "product": "TITLE ANIMATOR", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-06T20:24:28.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/98736b9d-3e0a-40c0-900a-fbbaaac07958?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/title-animator/trunk/inc/settings-page.php#L5"}, {"url": "https://plugins.trac.wordpress.org/browser/title-animator/tags/1.0/inc/settings-page.php#L5"}], "descriptions": [{"lang": "en", "value": "The TITLE ANIMATOR plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page form handler in `inc/settings-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:40.917Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1082", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:10:40.917Z", "dateReserved": "2026-01-16T20:37:32.569Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-07T08:26:39.384Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The TITLE ANIMATOR plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page form handler in `inc/settings-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin TITLE ANIMATOR para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.0, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en el manejador del formulario de la p\u00e1gina de configuraci\u00f3n en `inc/settings-page.php`. Esto hace posible que atacantes no autenticados modifiquen la configuraci\u00f3n del plugin a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-1082", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-02-07T09:15:59.910", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/title-animator/tags/1.0/inc/settings-page.php#L5"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/title-animator/trunk/inc/settings-page.php#L5"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/98736b9d-3e0a-40c0-900a-fbbaaac07958?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T18:43:29.579850+00:00", "value": {"mitigation_remediation": ["Upgrade the TITLE ANIMATOR plugin to the latest version that includes nonce validation on its settings form.", "If an immediate upgrade is not possible, disable or delete the plugin from the WordPress site to eliminate the risk.", "Review all configured settings and re\u2011apply any that were changed or reset them to secure values.", "Add a review process for all plugin updates and ensure that only trusted, updated plugins are enabled.", "Implement site\u2011wide logout or session invalidation upon administrative changes to mitigate potential CSRF exploitation."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Settings Change"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in all releases of the TITLE ANIMATOR plugin by arkapravamajumder up to and including version 1.0. No further version details are publicly listed.", "description_and_impact": "The TITLE ANIMATOR plugin for WordPress contains a Cross\u2011Site Request Forgery flaw that removes nonce validation from its settings page. This deficiency permits an attacker who can persuade a site administrator to click a crafted link to alter any of the plugin's configuration options. Although the change does not grant arbitrary code execution, it can modify visible site features or weaken security posture by enabling malicious options.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate risk, while the EPSS score of less than 1% suggests exploitation probability is very low. The flaw is not listed in CISA\u2019s KEV catalog. Attackers must first coerce a logged\u2011in administrator into performing an action that submits the forged request; no privileged access or network compromise is required. Once the CSRF attack succeeds, the attacker can change settings until the plugin is updated or the flaw is mitigated."}}}}, "created": "2026-02-09T10:44:36.746740+00:00", "updated": "2026-04-15T18:45:11.455607+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}