CVE-2026-6701: WordPress addfreespace Plugin CSRF Flaw

CVE-2026-6701 Overview

CVE-2026-6701 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the addfreespace plugin for WordPress in all versions up to and including 0.1.3. The flaw stems from missing or incorrect nonce validation on a plugin function. Unauthenticated attackers can update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a crafted link. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact

A successful attack lets an unauthenticated remote attacker modify plugin settings and inject persistent web scripts into a WordPress site by abusing an authenticated administrator's session.

Affected Products

• WordPress addfreespace plugin versions <= 0.1.3
• WordPress sites running the plugin's trunk branch with the unpatched code paths
• Any WordPress installation where the plugin is active and accessible to administrators

Discovery Timeline

• 2026-05-05 - CVE CVE-2026-6701 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-6701

Vulnerability Analysis

The addfreespace plugin exposes a settings update function that processes administrator-submitted data without verifying a valid WordPress nonce. WordPress nonces are single-use tokens that bind a state-changing request to a specific user session and action. When the nonce check is missing or implemented incorrectly, the server cannot distinguish a legitimate administrator submission from a forged cross-origin request.

Because the affected handler also accepts content that is later rendered without sufficient output encoding, an attacker can chain the CSRF primitive with stored script injection. The result is an unauthenticated path to persistent script execution in the context of the WordPress site, conditional on administrator interaction (UI:R).

The vulnerable code paths are documented in the public plugin source at lines 45 and 312 of addfreespace.php, and lines 30, 59, and 83 of addfreespace_functions.php. See the Wordfence Vulnerability Report for additional analysis.

Root Cause

The root cause is the absence or misuse of WordPress nonce validation primitives such as wp_verify_nonce() or check_admin_referer() on a state-changing administrative function. Without these checks, the plugin trusts any authenticated request reaching the handler, regardless of origin.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker hosts a page or sends a link containing a forged form or auto-submitting JavaScript that targets the vulnerable plugin endpoint. When an authenticated WordPress administrator visits the attacker-controlled resource, the browser submits the request with valid session cookies. The plugin then processes the attacker's payload, which can include script content that is later rendered to site visitors or administrators.

No verified public proof-of-concept exploit code is available. See the WordPress plugin source on Trac for the affected handler.

Detection Methods for CVE-2026-6701

Indicators of Compromise

• Unexpected modifications to addfreespace plugin settings stored in the WordPress wp_options table.
• Presence of <script> tags or HTML event handlers within plugin-managed content fields where they were not previously configured.
• Administrator-originated POST requests to plugin endpoints with Referer headers pointing to external or unrelated domains.

Detection Strategies

• Review web server access logs for POST requests to addfreespace.php or addfreespace_functions.php that lack a same-origin Referer or contain a _wpnonce parameter that fails validation.
• Compare current plugin option values against a known-good baseline to identify unauthorized configuration changes.
• Inspect rendered pages for unexpected inline scripts originating from plugin output.

Monitoring Recommendations

• Enable WordPress audit logging to record administrator-initiated option changes with timestamps and source IP.
• Forward web server and WordPress audit logs to a centralized SIEM for correlation against external referer anomalies.
• Alert on script-like content being written to plugin settings fields.

How to Mitigate CVE-2026-6701

Immediate Actions Required

• Deactivate and remove the addfreespace plugin from any WordPress site running version 0.1.3 or earlier until a patched release is available.
• Audit the WordPress wp_options table for plugin entries containing script payloads and remove any injected content.
• Rotate administrator credentials and invalidate active WordPress sessions if compromise is suspected.

Patch Information

No vendor patch is referenced in the available CVE data. Site operators should monitor the WordPress plugin repository for an updated release that introduces wp_verify_nonce() or check_admin_referer() calls on the affected handlers, and the Wordfence advisory for remediation status.

Workarounds

• Restrict access to the WordPress administrative interface using IP allowlists at the web server or WAF layer.
• Deploy a Web Application Firewall rule that blocks cross-origin POST requests to plugin endpoints lacking a valid same-site Referer.
• Train administrators to avoid clicking unsolicited links while authenticated to the WordPress dashboard.
• Use a separate browser profile or session for WordPress administration to reduce CSRF exposure.

# Configuration example - Apache rule to block cross-origin POSTs to the plugin
<LocationMatch "/wp-content/plugins/addfreespace/">
    <RequireAll>
        Require method GET HEAD
    </RequireAll>
</LocationMatch>