Description
The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefy_embed_options_update' settings update action. This makes it possible for unauthenticated attackers to update the plugin's settings, including the API key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2025-12-12
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch Now
AI Analysis

Impact

The Truefy Embed plugin fails to perform nonce validation on the truefy_embed_options_update action, allowing an unauthenticated attacker to forge a request that causes an authenticated administrator to change the plugin’s settings, including the API key. By exploiting this flaw the attacker can gain unauthorized control over the plugin configuration, potentially leading to further compromise of the site.

Affected Systems

All WordPress sites that use the Truefy Embed plugin version 1.1.0 or earlier are impacted. No specific WordPress core version is noted, so any installation running the affected plugin is at risk.

Risk and Exploitability

The CVSS score for this issue is 4.3 and the EPSS score is below 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via a CSRF attack: an adversary convinces a logged‑in administrator to click a crafted link or submit a malicious form, which then updates the plugin settings without further authentication.

Generated by OpenCVE AI on April 21, 2026 at 17:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Truefy Embed plugin to the latest available release.
  • If an upgrade is not available, deactivate or uninstall the plugin to prevent further configuration changes.
  • Educate site administrators not to click on unknown or suspicious links while logged into the WordPress admin area.

Generated by OpenCVE AI on April 21, 2026 at 17:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 15 Dec 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 12 Dec 2025 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Fri, 12 Dec 2025 03:45:00 +0000

Type Values Removed Values Added
Description The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefy_embed_options_update' settings update action. This makes it possible for unauthenticated attackers to update the plugin's settings, including the API key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Title Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:01:12.525Z

Reserved: 2025-12-05T20:43:20.316Z

Link: CVE-2025-14161

cve-icon Vulnrichment

Updated: 2025-12-12T20:24:46.979Z

cve-icon NVD

Status : Deferred

Published: 2025-12-12T04:15:48.770

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-14161

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T17:30:37Z

Weaknesses