CVE-2026-6405: Anomify AI WordPress Plugin CSRF Vulnerability

CVE-2026-6405 Overview

CVE-2026-6405 affects the Anomify AI – Anomaly Detection and Alerting plugin for WordPress in versions up to and including 0.3.6. The flaw chains a Cross-Site Request Forgery (CSRF) weakness with a Stored Cross-Site Scripting (XSS) sink in the plugin's admin settings page. Unauthenticated attackers can trick an authenticated administrator into submitting a forged request that writes attacker-controlled script into the plugin configuration. The payload then executes in any administrator's browser when the settings screen is viewed. The vulnerability is tracked under [CWE-352].

Critical Impact
A successful attack stores JavaScript in the WordPress database and executes it in an administrator's browser session, enabling account takeover, content tampering, and pivoting to additional administrative actions.

Affected Products

Anomify AI – Anomaly Detection and Alerting plugin for WordPress
All versions up to and including 0.3.6
Vulnerable files: Anomify/Config.php, Anomify/Wp/Admin.php, and Anomify/Wp/includes/admin_options.php

Discovery Timeline

2026-05-20 - CVE-2026-6405 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-6405

Vulnerability Analysis

The vulnerability is a chained CSRF-to-Stored-XSS issue in the plugin's administrative settings handler. The settings form rendered by admin_options.php does not emit a wp_nonce_field(), and the corresponding POST handler in Anomify/Wp/Admin.php does not call check_admin_referer() or wp_verify_nonce(). Any cross-origin POST submitted by a logged-in administrator's browser is therefore accepted as a legitimate configuration change.

The API key value submitted through the form is passed through sanitize_text_field() before being persisted. That function strips HTML tags and control characters, but it does not encode double-quote characters. When the stored value is later rendered back into the settings page, it is emitted with a bare echo inside an HTML attribute context, without esc_attr(). A payload containing a double-quote followed by event-handler syntax breaks out of the attribute and executes in the administrator's browser.

Exploitation requires user interaction: an administrator must visit an attacker-controlled page while authenticated to WordPress. No prior privileges on the target site are required from the attacker.

Root Cause

The root cause is two compounding defects. First, the settings form lacks WordPress's standard nonce protection, eliminating the framework-provided CSRF defense. Second, the output rendering path violates context-aware escaping by using sanitize_text_field() as an output filter and omitting esc_attr() when injecting the value into an HTML attribute.

Attack Vector

The attacker hosts a page containing an auto-submitting HTML form that targets the plugin's WordPress admin endpoint. The form's API key field carries a payload that closes the surrounding attribute with a double-quote and injects a JavaScript event handler. When an authenticated WordPress administrator loads the attacker page, the browser submits the forged request, the plugin persists the payload, and the script fires on the next visit to the Anomify settings page.

Review the vendor source for the specific code paths in Anomify Config.php, Anomify Wp/Admin.php, and Anomify admin_options.php. Verified proof-of-concept code is not publicly available; see the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-6405

Indicators of Compromise

Unexpected values in the Anomify plugin's API key option in the wp_options table containing characters such as ", <, >, or event-handler substrings like onerror= or onfocus=.
WordPress access logs showing POST requests to the Anomify settings handler with a Referer header pointing to an external domain.
Administrator session anomalies, such as unexpected user creation, role changes, or plugin installs occurring shortly after an admin visited the Anomify settings page.

Detection Strategies

Query the WordPress options table for Anomify-related rows and inspect stored values for HTML metacharacters or JavaScript syntax.
Inspect web server and WordPress audit logs for admin-post.php or settings POST requests targeting the Anomify handler where the Origin or Referer is not the site itself.
Monitor outbound network traffic from administrator workstations for connections to unknown domains immediately after browsing wp-admin pages.

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture settings changes, including the originating user, IP address, and request headers.
Alert on any modification to plugin options outside of approved maintenance windows.
Continuously inventory installed WordPress plugins and their versions to flag instances of Anomify at 0.3.6 or earlier.

How to Mitigate CVE-2026-6405

Immediate Actions Required

Deactivate the Anomify AI plugin on any WordPress site running version 0.3.6 or earlier until a patched release is installed.
Audit the Anomify settings, clear any suspicious API key value, and re-enter the key from a trusted source.
Force-reset administrator sessions and rotate credentials for accounts that may have visited the settings page during the exposure window.

Patch Information

No fixed version is identified in the NVD record at the time of publication. Monitor the WordPress plugin repository and the Wordfence advisory for a patched release that adds wp_nonce_field() and check_admin_referer() to the settings flow and applies esc_attr() on output.

Workarounds

Remove or deactivate the plugin until an updated version is published by the vendor.
Restrict access to wp-admin by source IP using web server rules or a web application firewall to reduce CSRF exposure.
Train administrators to log out of WordPress before browsing unrelated sites and to use a dedicated browser profile for administrative work.

bash

# Example: deactivate the vulnerable plugin using WP-CLI
wp plugin deactivate anomify
wp plugin status anomify