CVE-2026-2410: WordPress Disable Admin Notices CSRF Flaw

CVE-2026-2410 Overview

The Disable Admin Notices – Hide Dashboard Notifications plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.4.2. The vulnerability stems from missing nonce validation in the showPageContent() function, which enables unauthenticated attackers to manipulate the blocked redirects list through forged requests.

Critical Impact

Unauthenticated attackers can add arbitrary URLs to the blocked redirects list by tricking a site administrator into clicking a malicious link, potentially disrupting site navigation and functionality.

Affected Products

• Disable Admin Notices – Hide Dashboard Notifications plugin for WordPress versions ≤ 1.4.2

Discovery Timeline

• 2026-02-25 - CVE CVE-2026-2410 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-2410

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The core issue lies in the plugin's failure to implement proper nonce validation within the showPageContent() function located in class-pages-edit-redirects.php. WordPress nonces are security tokens used to verify that requests originated from legitimate user actions on the site. Without this validation, the application cannot distinguish between authentic administrative actions and forged requests initiated by an attacker.

The vulnerability requires user interaction for exploitation—specifically, an administrator must be tricked into clicking a malicious link or visiting an attacker-controlled page while authenticated to their WordPress dashboard. This social engineering requirement limits the immediate exploitability but does not diminish the risk in targeted attack scenarios.

Root Cause

The root cause is the absence of nonce verification in the showPageContent() function within the plugin's redirect management functionality. WordPress provides built-in functions like wp_verify_nonce() and check_admin_referer() to validate that form submissions and AJAX requests originate from authorized users. The vulnerable code path processes redirect URL modifications without confirming the authenticity of the request, allowing cross-origin requests to be processed as if they were legitimate administrative actions.

Attack Vector

The attack is network-based and requires no authentication to initiate. An attacker crafts a malicious webpage or email containing a forged request targeting the vulnerable plugin endpoint. When an authenticated WordPress administrator interacts with this malicious content (such as clicking a link or loading an embedded resource), their browser automatically includes their valid session cookies with the forged request. The WordPress installation processes this request as a legitimate administrative action, adding attacker-specified URLs to the blocked redirects list.

This can be exploited to:

• Add legitimate internal URLs to the blocked list, disrupting site navigation
• Interfere with critical redirect functionality
• Create confusion for site administrators by unexpectedly blocking URLs

The vulnerability mechanism involves crafting a form or request that targets the plugin's redirect management endpoint. When an admin visits the attacker's page while logged into WordPress, the browser automatically submits the request with the admin's session, bypassing authentication since no CSRF token is validated. For technical implementation details, refer to the WordPress Plugin Code Reference.

Detection Methods for CVE-2026-2410

Indicators of Compromise

• Unexpected entries appearing in the plugin's blocked redirects list that were not added by administrators
• Audit logs showing redirect list modifications without corresponding administrator sessions
• Users or administrators reporting unexpected behavior with site redirects
• Referrer headers in access logs pointing to external or unknown domains for plugin configuration requests

Detection Strategies

• Review WordPress access logs for POST requests to the plugin's redirect management endpoints from external referrers
• Implement Web Application Firewall (WAF) rules to detect and block requests lacking proper nonce tokens
• Monitor for rapid or bulk changes to the blocked redirects configuration that deviate from normal administrative patterns
• Deploy browser-based CSRF protection mechanisms and Content Security Policy headers

Monitoring Recommendations

• Enable detailed logging for WordPress plugin configuration changes
• Set up alerts for modifications to the Disable Admin Notices plugin settings outside of expected administrative windows
• Regularly audit the blocked redirects list for unauthorized or suspicious entries
• Monitor administrator email accounts for phishing attempts that may be leveraging this vulnerability

How to Mitigate CVE-2026-2410

Immediate Actions Required

• Update the Disable Admin Notices – Hide Dashboard Notifications plugin to a version newer than 1.4.2 immediately
• Audit the current blocked redirects list for any unauthorized entries and remove suspicious URLs
• Educate administrators about the risks of clicking unknown links while authenticated to WordPress
• Consider temporarily disabling the plugin if an immediate update is not possible

Patch Information

The vulnerability has been addressed in versions released after 1.4.2. The fix implements proper nonce validation in the showPageContent() function. The patch details can be reviewed in the WordPress Change Set #3463239. For additional context, see the Wordfence Vulnerability Report.

Workarounds

• Restrict administrative access to WordPress from trusted networks only using IP allowlisting
• Implement additional CSRF protection at the web server or WAF level
• Advise administrators to use a separate browser session or incognito mode when visiting untrusted websites
• Enable two-factor authentication for all WordPress administrator accounts to add an additional layer of protection

# Verify current plugin version via WP-CLI
wp plugin list --name=disable-admin-notices --fields=name,version,status

# Update the plugin to the latest version
wp plugin update disable-admin-notices

# Audit blocked redirects configuration (check plugin settings in database)
wp db query "SELECT * FROM wp_options WHERE option_name LIKE '%disable_admin_notices%';"