CVE-2026-3772 WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
Attackers can trick admins into executing arbitrary code via CSRF in WP Editor, leading to remote code execution and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-3772?
CVE-2026-3772 is a high-severity vulnerability in benjaminprojas WP Editor, published on 1 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
Weakness: CWE-352
Which versions are affected by CVE-2026-3772?
How do I fix CVE-2026-3772?
No fix has been published for CVE-2026-3772 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-3772 being exploited?
There is no known exploitation of CVE-2026-3772 in the wild and no public exploit code.
Sources
Also known as GHSA-c7hq-c9cq-6m7w.