CVE-2026-66669

Summary

A CSRF vulnerability in the Suplugins Superb Addons plugin (versions through 4.2.4) allows attackers to trick authenticated administrators into performing unintended actions, such as modifying theme settings or injecting malicious content, by exploiting the lack of anti-CSRF tokens in sensitive requests.

Exploitability

Exploitation requires social engineering to诱导 a logged-in administrator with sufficient privileges to visit a malicious page that triggers forged requests; no authentication bypass or complex conditions are needed beyond user interaction.

Blast radius

Successful exploitation could lead to full compromise of the WordPress site, including unauthorized theme modifications, insertion of backdoor patterns, or defacement, depending on the capabilities exposed by the vulnerable endpoints.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Superb Addons version 4.2.5 or later, which includes CSRF token enforcement for all state-changing requests.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.