{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3331", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-27T14:40:15.817Z", "datePublished": "2026-03-21T03:26:52.736Z", "dateUpdated": "2026-04-08T17:02:30.828Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:30.828Z"}, "affected": [{"vendor": "chuckmo", "product": "Lobot Slider Administrator", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing or incorrect nonce validation on the fourty_slider_options_page function. This makes it possible for unauthenticated attackers to modify plugin slider-page configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Lobot Slider Administrator <= 0.6.0 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b7c9123-a918-4fc0-9b16-f537b418b990?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lobot-slider-administrator/trunk/lobot-slider-administrator.php#L33"}, {"url": "https://plugins.trac.wordpress.org/browser/lobot-slider-administrator/tags/0.6.0/lobot-slider-administrator.php#L33"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-03-20T15:13:22.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:07:38.756675Z", "id": "CVE-2026-3331", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:54:26.901Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3331", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-27T14:40:15.817Z", "datePublished": "2026-03-21T03:26:52.736Z", "dateUpdated": "2026-03-23T15:54:26.901Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-21T03:26:52.736Z"}, "affected": [{"vendor": "chuckmo", "product": "Lobot Slider Administrator", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "0.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing or incorrect nonce validation on the fourty_slider_options_page function. This makes it possible for unauthenticated attackers to modify plugin slider-page configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Lobot Slider Administrator <= 0.6.0 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b7c9123-a918-4fc0-9b16-f537b418b990?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lobot-slider-administrator/trunk/lobot-slider-administrator.php#L33"}, {"url": "https://plugins.trac.wordpress.org/browser/lobot-slider-administrator/tags/0.6.0/lobot-slider-administrator.php#L33"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-03-20T15:13:22.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3331", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:07:38.756675Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:07:39.786Z"}}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing or incorrect nonce validation on the fourty_slider_options_page function. This makes it possible for unauthenticated attackers to modify plugin slider-page configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Lobot Slider Administrator para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en versiones hasta la 0.6.0, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la funci\u00f3n fourty_slider_options_page. Esto hace posible que atacantes no autenticados modifiquen la configuraci\u00f3n de la p\u00e1gina de control deslizante del plugin a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-3331", "lastModified": "2026-04-24T16:27:44.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-03-21T04:17:19.090", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lobot-slider-administrator/tags/0.6.0/lobot-slider-administrator.php#L33"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lobot-slider-administrator/trunk/lobot-slider-administrator.php#L33"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b7c9123-a918-4fc0-9b16-f537b418b990?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.6.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Lobot Slider Administrator", "source": "cna", "vendor": "chuckmo"}, "product": "lobot_slider_administrator", "vendor": "chuckmo"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T07:16:33.799992+00:00", "value": {"mitigation_remediation": ["Update the Lobot Slider Administrator plugin to the latest version released after 0.6.0"], "summary": {"action": "Immediate Patch", "impact": "Unauthorized configuration changes to the Lobot Slider Administrator plugin"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all installations of the Lobot Slider Administrator WordPress plugin with versions up to and including 0.6.0. Users who have not upgraded beyond version 0.6.0 are potentially exposed if a site administrator is targeted by a social\u2011engineering attack. The affected vendor is chuckmo, and the plugin name is Lobot Slider Administrator.", "description_and_impact": "The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross\u2011Site Request Forgery due to missing or incorrect nonce validation in the fourty_slider_options_page function. This flaw allows an unauthenticated attacker who can entice a site administrator into clicking a crafted link to modify the plugin\u2019s slider\u2011page configuration without authorization. The possible impact includes unauthorized changes to how the slider displays or functions, which could alter the site\u2019s appearance or lead to unauthorized content injection.", "risk_and_exploitability": "The CVSS base score of 4.3 indicates a medium severity rating. The exploit requires an attacker to get a site administrator to submit a forged request; therefore it is not a purely remote exploitation vector and no publicly disclosed exploits are available. The vulnerability is not in the CISA KEV catalog and there is no EPSS score. Because the attacker can potentially alter settings, the overall risk is moderate, but applying the vendor\u2019s update immediately mitigates the issue."}}}}, "created": "2026-03-23T09:50:19.707087+00:00", "updated": "2026-03-25T14:42:00.020527+00:00", "vendors": ["chuckmo", "chuckmo$PRODUCT$lobot_slider_administrator", "wordpress", "wordpress$PRODUCT$wordpress"]}