CVE-2026-125784: WordPress RestroPress plugin <= 3.4.11 - Cross Site Request Forgery (CSRF) vulnerability

Q: What must an attacker do to exploit this issue?

An attacker would need to persuade a user to interact with a malicious request, as indicated by the required user interaction in the CVSS vector. No attacker privileges are required.

Q: Which RestroPress installations are affected?

RestroPress versions through 3.4.11 are affected. The available data does not identify a fixed version or any configuration-based exceptions.

Published Nov 11, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress RestroPress plugin to a version that resolves this vulnerability.
Fixed in 3.5.0

Event History

Nov 11, 2026

CVE Published

via MITRE·11:37 AM

Data Sourced

via MITRE·11:37 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker would need to persuade a user to interact with a malicious request, as indicated by the required user interaction in the CVSS vector. No attacker privileges are required.

Which RestroPress installations are affected?

RestroPress versions through 3.4.11 are affected. The available data does not identify a fixed version or any configuration-based exceptions.

CVE-2026-125784: WordPress RestroPress plugin <= 3.4.11 - Cross Site Request Forgery (CSRF) vulnerability

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which RestroPress installations are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which RestroPress installations are affected?