CVE-2026-122003: Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF

Q: Who is exposed to this issue?

WordPress sites using Abilities Bridge versions before 1.4.2 are exposed when a user is logged in with an administrator account.

Q: What does an attacker need to exploit it?

An attacker needs to trick a logged-in administrator into opening a crafted page. No valid nonce is required for the affected REST API re-authentication flow.

Q: What could exploitation allow?

An attacker can cause the administrator's session to perform REST API actions, including creating a new administrator account. This can enable takeover of the WordPress site.

Q: How can I tell whether my site is affected?

Check the installed Abilities Bridge plugin version. Versions before 1.4.2 are affected.

Published Nov 12, 2026

Updated

The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and taking over the site, by tricking them into opening a crafted page (CSRF).

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using Abilities Bridge versions before 1.4.2 are exposed when a user is logged in with an administrator account.

What does an attacker need to exploit it?

An attacker needs to trick a logged-in administrator into opening a crafted page. No valid nonce is required for the affected REST API re-authentication flow.

What could exploitation allow?

An attacker can cause the administrator's session to perform REST API actions, including creating a new administrator account. This can enable takeover of the WordPress site.

How can I tell whether my site is affected?

Check the installed Abilities Bridge plugin version. Versions before 1.4.2 are affected.

CVE-2026-122003: Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could exploitation allow?

How can I tell whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could exploitation allow?

How can I tell whether my site is affected?