CVE-2026-6395: Word 2 Cash Plugin CSRF Vulnerability

CVE-2026-6395 Overview

CVE-2026-6395 affects the Word 2 Cash plugin for WordPress in versions up to and including 0.9.2. The vulnerability combines Cross-Site Request Forgery (CSRF) with Stored Cross-Site Scripting (XSS) in the plugin's settings save handler. The w2c_admin() function lacks nonce verification, input sanitization, and output escaping when handling the w2c-definitions POST parameter. Unauthenticated attackers can craft malicious requests that, when triggered by an authenticated administrator, store arbitrary JavaScript in plugin settings. The payload executes whenever an administrator views the settings page. The vulnerability is tracked under CWE-352.

Critical Impact
Successful exploitation results in stored JavaScript execution within the WordPress admin panel, enabling session theft, account takeover, and persistent backdoor injection.

Affected Products

Word 2 Cash plugin for WordPress, versions up to and including 0.9.2
WordPress installations with the plugin active and accessible to administrators
All sites running the vulnerable word2cash.php handler

Discovery Timeline

2026-05-20 - CVE-2026-6395 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-6395

Vulnerability Analysis

The Word 2 Cash plugin exposes a settings handler in the w2c_admin() function that processes administrative form submissions. The handler accepts the w2c-definitions POST parameter and writes it directly to the WordPress options table using update_option(). No nonce check guards the save operation, breaking the CSRF protection model WordPress provides through wp_nonce_field() and check_admin_referer().

The stored value is later rendered inside a <textarea> element on the settings page. The plugin omits escaping functions such as esc_textarea() or esc_html() during output. This combination converts a CSRF flaw into a persistent script injection vector reachable by any unauthenticated attacker capable of luring an administrator to a malicious page.

Root Cause

Three compounding defects produce the vulnerability. First, the save handler omits nonce verification, allowing forged cross-origin requests. Second, the handler stores the raw w2c-definitions parameter without applying sanitize_text_field() or equivalent filtering. Third, the rendering logic echoes the stored option directly into HTML without output escaping.

Attack Vector

An unauthenticated attacker hosts a page containing a hidden form targeting the WordPress admin settings endpoint with a crafted w2c-definitions value. When an authenticated administrator visits the attacker-controlled page, the browser submits the request using the administrator's session cookies. The injected payload persists in the database and executes for every subsequent administrator visit to the settings screen.

The vulnerability allows attackers to escalate to full site compromise by creating rogue administrator accounts, modifying plugin code, or injecting redirects through admin-context JavaScript execution. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical details.

Detection Methods for CVE-2026-6395

Indicators of Compromise

Unexpected <script> tags or HTML event handlers stored within the w2c-definitions option in the wp_options table
POST requests to the Word 2 Cash admin settings page originating from external referers
Creation of new administrator accounts immediately following admin visits to the plugin settings screen
Outbound HTTP requests from administrator browsers to attacker-controlled domains after settings page access

Detection Strategies

Query the WordPress options table for the w2c-definitions value and inspect for HTML tags, JavaScript keywords, or event handler attributes such as onerror= and onload=
Monitor web server access logs for POST requests to WordPress admin endpoints lacking a same-origin referer header
Review WordPress audit logs for option changes correlated with administrator sessions and external referers

Monitoring Recommendations

Enable file integrity monitoring for the wp-content/plugins/word-2-cash/ directory
Forward WordPress audit and access logs to a centralized SIEM for correlation with administrator authentication events
Alert on administrator account creation events that occur within minutes of plugin settings page access

How to Mitigate CVE-2026-6395

Immediate Actions Required

Deactivate and remove the Word 2 Cash plugin until a patched version is released
Inspect the w2c-definitions option value in wp_options and remove any injected script content
Audit administrator accounts and revoke any created during the exposure window
Force password resets and session invalidation for all WordPress administrators

Patch Information

No patched version is referenced in the published advisory. Versions up to and including 0.9.2 remain vulnerable. Site operators should track the Wordfence Vulnerability Report for fix availability and uninstall the plugin in the interim.

Workarounds

Restrict access to /wp-admin/ using IP allowlists or VPN-only access enforced at the web server or WAF layer
Deploy a Web Application Firewall rule blocking POST requests to the plugin settings endpoint that lack a valid same-origin referer
Train administrators to authenticate to WordPress only in isolated browser sessions and avoid clicking external links while logged in
Apply the principle of least privilege by limiting the number of accounts holding the administrator role

bash

# Example WAF rule (ModSecurity) blocking cross-origin POSTs to wp-admin
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:1,deny,status:403,id:1026639501,\
  msg:'Blocked cross-origin POST to WordPress admin'"
SecRule REQUEST_URI "@contains /wp-admin/" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/"