CVE-2026-122003— Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF
Quick assessment
Affected
Unknown Abilities Bridge
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 1.4.2 版本之前的 Abilities Bridge WordPress 插件中，在通过已登录会话 cookie 对 REST API 请求进行重新认证时，未要求提供有效的 nonce（一次性令牌）。这使得攻击者能够诱骗已登录的管理员打开精心构造的页面，从而利用跨站请求伪造（CSRF）漏洞，让该管理员执行任意 REST API 操作，包括创建新的管理员账户并接管整个网站。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-122003
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and taking over the site, by tricking them into opening a crafted page (CSRF).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Abilities Bridge | 0 ~ 1.4.2 | - |
|
II. Public POCs for CVE-2026-122003
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-122003
请登录查看更多情报信息。
Other References for CVE-2026-122003 (1)
-
https://wpscan.com/vulnerability/e421e862-8d7a-4df6-9c5e-dc06a466a0fc/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total
| CVE-2026-121498 | Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR | |
| CVE-2026-110072 | Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr | |
| CVE-2026-110041 | Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST E | |
| CVE-2026-106027 | Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v | |
| CVE-2026-110959 | Descope < 1.2.0 - Unauthenticated Account Takeover | |
| CVE-2026-119039 | Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detecti | |
| CVE-2026-118421 | WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter | |
| CVE-2026-118531 | Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update | |
| CVE-2026-123044 | ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure | |
| CVE-2026-119040 | Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification | |
| CVE-2026-76792 | User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP L | |
| CVE-2026-123092 | WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio | |
| CVE-2026-124652 | Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR | |
| CVE-2026-124653 | Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure | |
| CVE-2026-124647 | TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie | |
| CVE-2026-124648 | TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key | |
| CVE-2026-124815 | Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions | |
| CVE-2026-124814 | Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 't | |
| CVE-2026-124817 | Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification | |
| CVE-2026-124665 | Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure v |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-76792
User Verification 2.0.38 - 2.0.48 - Unauthenticated Account -
CVE-2026-124665
Order Tracking < 3.6.2 - Unauthenticated Customer and Sales -
CVE-2026-124817
Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modi -
CVE-2026-124814
Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticate -
CVE-2026-124815
Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record D