CVE-2026-3565: Taqnix WordPress Plugin CSRF Vulnerability

CVE-2026-3565 Overview

CVE-2026-3565 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Taqnix plugin for WordPress in all versions up to and including 1.0.3. The flaw originates in the taqnix_delete_my_account() function, where the check_ajax_referer() nonce verification call is explicitly commented out on line 883 of class-taqnix-user.php. Unauthenticated attackers can exploit this weakness to trick a logged-in non-administrator user into deleting their own account by enticing them to click a malicious link or visit a crafted page. The issue is tracked under [CWE-352].

Critical Impact
Unauthenticated attackers can force authenticated WordPress users to delete their own accounts through forged HTTP requests, resulting in loss of user data and access.

Affected Products

Taqnix plugin for WordPress (all versions through 1.0.3)
WordPress sites with the Taqnix plugin installed and active
Non-administrator user accounts on affected installations

Discovery Timeline

2026-04-24 - CVE-2026-3565 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-3565

Vulnerability Analysis

The Taqnix plugin exposes an AJAX endpoint backed by the taqnix_delete_my_account() function. WordPress provides the check_ajax_referer() helper to validate a nonce token tied to the authenticated user session, which is the standard defense against Cross-Site Request Forgery. In the vulnerable build, this verification is disabled because the call is commented out on line 883 of public/class-taqnix-user.php. The handler proceeds to delete the currently authenticated user without confirming that the request originated from a legitimate plugin form.

Because the action relies on the victim's existing WordPress authentication cookie, the attacker does not need credentials. They only need the victim to load attacker-controlled content while logged in. Administrator accounts are not the primary target, but any non-administrator user authenticated to the site can be coerced into account deletion.

Root Cause

The root cause is missing nonce verification on a state-changing AJAX action. The commented-out check_ajax_referer() call removes the only origin-validation control on the delete account workflow, leaving the endpoint reliant solely on the browser-supplied session cookie, which is automatically attached to cross-origin requests.

Attack Vector

Exploitation requires user interaction. An attacker hosts a page containing an automatically submitted form or fetch() request targeting the Taqnix AJAX action on the victim's WordPress site. When a logged-in user visits the page, the browser attaches the WordPress session cookie and the server executes the deletion. The attack is network-reachable, requires no privileges from the attacker, and impacts integrity by destroying the target account.

No verified public exploit code is available. Technical details are documented in the Wordfence Vulnerability Analysis and the WordPress Taqnix plugin source.

Detection Methods for CVE-2026-3565

Indicators of Compromise

Unexpected user deletion events in the WordPress wp_users table or audit logs for non-administrator accounts.
AJAX requests to admin-ajax.php with the Taqnix delete action and a Referer header pointing to an external or unexpected domain.
Missing or absent _wpnonce parameter on requests reaching the taqnix_delete_my_account handler.

Detection Strategies

Review web server access logs for POST requests to wp-admin/admin-ajax.php invoking Taqnix actions with cross-origin Referer or Origin headers.
Correlate user deletion events with preceding HTTP referrers to identify forged requests originating from external domains.
Inventory WordPress installations to identify sites running Taqnix 1.0.3 or earlier.

Monitoring Recommendations

Enable a WordPress activity log plugin to capture user deletion events with source IP and referrer metadata.
Alert on bursts of user account deletions in a short time window, which may indicate mass CSRF exploitation.
Monitor outbound traffic from user workstations to known malicious hosting domains that could deliver CSRF payloads.

How to Mitigate CVE-2026-3565

Immediate Actions Required

Identify all WordPress installations running the Taqnix plugin and confirm the installed version.
Deactivate the Taqnix plugin on any site running version 1.0.3 or earlier until a patched release is installed.
Notify non-administrator users to avoid clicking untrusted links while authenticated to the affected site.

Patch Information

At the time of publication, no fixed version is listed in the NVD record. Administrators should monitor the WordPress Taqnix changeset history and the Wordfence advisory for an updated release that restores the check_ajax_referer() call in taqnix_delete_my_account().

Workarounds

Deactivate and remove the Taqnix plugin until a vendor patch is published.
Deploy a Web Application Firewall rule that blocks requests to the Taqnix AJAX action lacking a valid same-origin Referer or Origin header.
Enforce SameSite=Lax or SameSite=Strict cookies on WordPress authentication to reduce automatic cookie attachment on cross-site requests.

bash

# Example WAF rule (ModSecurity) blocking cross-origin Taqnix delete requests
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026003565,msg:'CVE-2026-3565 Taqnix CSRF block'"
  SecRule ARGS:action "@streq taqnix_delete_my_account" "chain"
    SecRule REQUEST_HEADERS:Origin "!@beginsWith https://your-site.example"