CVE-2026-0739 Overview
CVE-2026-0739 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WMF Mobile Redirector plugin for WordPress in all versions up to and including 1.2. The flaw exists in the plugin settings due to insufficient input sanitization and output escaping [CWE-79]. Authenticated attackers with Administrator-level access or higher can inject arbitrary web scripts that execute when any user views an affected page. The vulnerability is tracked with a CVSS 3.1 base score of 4.4 and was published to the National Vulnerability Database (NVD) on January 14, 2026.
Critical Impact
Attackers with administrator privileges can persist malicious JavaScript in the plugin settings, executing in the browsers of site visitors and administrators.
Affected Products
- WMF Mobile Redirector plugin for WordPress, versions through 1.2
- WordPress sites with the plugin installed and configured
- Administrator and higher-privileged user sessions that access affected pages
Discovery Timeline
- 2026-01-14 - CVE-2026-0739 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-0739
Vulnerability Analysis
The vulnerability resides in the plugin's settings handler, specifically in includes/options-page.php at lines 55 and 62. The plugin accepts administrator-supplied input through its options page and stores the values in the WordPress database. When the stored values are later rendered, the plugin fails to apply adequate output escaping, allowing embedded HTML and JavaScript to execute in the browser context.
Because the injected payload is stored, it persists across sessions and triggers each time a user accesses an affected page. The CVSS vector indicates a scope change (S:C), meaning the injected script can affect resources beyond the vulnerable component itself. Both confidentiality and integrity impacts are rated low, with no direct availability impact.
The Exploit Prediction Scoring System (EPSS) currently rates exploitation likelihood as very low, and no public proof-of-concept exploit is available.
Root Cause
The root cause is missing sanitization on input and missing output escaping when rendering plugin settings values. WordPress provides functions such as sanitize_text_field(), esc_attr(), and esc_html() for these purposes, but the affected code paths in options-page.php do not apply them consistently to user-supplied option values.
Attack Vector
An attacker must already hold Administrator-level access on the target WordPress site. The attacker submits crafted input through the plugin's options page, which is stored in the WordPress wp_options table. When any user — including other administrators or editors — loads a page that renders the stored value, the injected script executes in their browser. This can be leveraged to escalate impact within the WordPress admin context, hijack sessions, or pivot to other accounts.
No verified exploit code is publicly available. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Reference for the affected source lines.
Detection Methods for CVE-2026-0739
Indicators of Compromise
- Unexpected <script>, onerror, or onload content stored in WMF Mobile Redirector option values within wp_options.
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading WordPress admin pages.
- Newly created administrator accounts or unexpected changes to user roles following plugin settings modifications.
Detection Strategies
- Audit the wp_options table for entries associated with the wmf-mobile-redirector plugin and inspect them for HTML or JavaScript content.
- Review WordPress audit logs for plugin settings updates performed by administrator accounts.
- Compare the rendered HTML of plugin-managed pages against expected output to identify injected scripts.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record every settings change, including the user, timestamp, and modified value.
- Monitor web server logs for POST requests to options.php or plugin-specific admin endpoints containing script-like payloads.
- Configure a Content Security Policy (CSP) and alert on CSP violation reports generated by the WordPress admin interface.
How to Mitigate CVE-2026-0739
Immediate Actions Required
- Update the WMF Mobile Redirector plugin to a patched version once released, or deactivate and remove the plugin if no fix is available.
- Review existing plugin settings and remove any values containing HTML tags or JavaScript.
- Rotate credentials for any administrator account suspected of being compromised, and review recent administrator activity.
Patch Information
At the time of publication, the vulnerability affects all versions up to and including 1.2. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory for an updated release that applies proper input sanitization and output escaping.
Workarounds
- Restrict Administrator-level access to a minimal set of trusted users and enforce multi-factor authentication on all administrator accounts.
- Deploy a Web Application Firewall (WAF) with rules that block script payloads submitted to WordPress admin endpoints.
- Apply a strict Content Security Policy that disallows inline scripts in the WordPress admin interface to limit XSS impact.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
