Description
The Set Bulk Post Categories plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation on the bulk category update functionality. This makes it possible for unauthenticated attackers to modify post categories in bulk via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2026-01-24
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Cross‑Site Request Forgery that allows bulk modification of post categories
Action: Update Plugin
AI Analysis

Impact

The Set Bulk Post Categories plugin contains a missing nonce check in its bulk category update feature, enabling a Cross‑Site Request Forgery (CSRF) flaw. An attacker can craft a forged request which, if an administrator visits a malicious link, will execute the bulk update and re‑categorize arbitrary posts. This problem is identified as CWE‑352 and compromises the integrity of site content.

Affected Systems

Sauravrox Set Bulk Post Categories plugin for WordPress, versions 1.1 and below.

Risk and Exploitability

The CVSS score of 4.3 reflects low severity, while the EPSS score of <1% indicates a low probability of exploitation at present. The vulnerability does not appear in the CISA KEV catalog. Likely exploitation requires a social‑engineering step where an attacker forces an authenticated administrator to click a crafted link, thereby sending the forged request with adequate privileges.

Generated by OpenCVE AI on April 15, 2026 at 21:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Sauravrox Set Bulk Post Categories to a version that implements nonce validation or apply any vendor‑supplied patch.
  • If a patch or upgrade is not available, deactivate or uninstall the plugin until protection is restored.
  • Enforce stronger administrator safeguards, such as two‑factor authentication, and educate admins to avoid clicking suspicious links or visiting untrusted external sites.

Generated by OpenCVE AI on April 15, 2026 at 21:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Jan 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Jan 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Sat, 24 Jan 2026 07:45:00 +0000

Type Values Removed Values Added
Description The Set Bulk Post Categories plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation on the bulk category update functionality. This makes it possible for unauthenticated attackers to modify post categories in bulk via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Title Set Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:09:58.008Z

Reserved: 2026-01-16T20:36:19.873Z

Link: CVE-2026-1081

cve-icon Vulnrichment

Updated: 2026-01-26T15:29:29.926Z

cve-icon NVD

Status : Deferred

Published: 2026-01-24T08:16:08.313

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-1081

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T21:45:14Z

Weaknesses