Webmaster Tools Verification <= 1.2 - Unauthenticated Arbitrary Plugin Deactivation
Description
The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WordPress/Webmaster Tools Verificationdescription
- Range: <=1.2
Patches
Vulnerability mechanics
Root cause
"Missing authorization and CSRF checks in the plugin's plugin-disabling functionality allow unauthenticated attackers to deactivate arbitrary plugins."
Attack vector
An unauthenticated attacker can send a crafted request to the WordPress admin AJAX endpoint that triggers the plugin's plugin-deactivation routine. Because the plugin lacks both authorization checks (CWE-862) and CSRF nonce validation, no authentication or user interaction is required [ref_id=1]. The attacker simply needs to know or guess the slug of the target plugin to disable it.
Affected code
The advisory does not specify exact file paths or function names [ref_id=1]. The vulnerable functionality resides within the Webmaster Tools Verification plugin (slug: webmaster-tools-verification) version 1.2 and earlier, in the code path that handles plugin deactivation requests.
What the fix does
No patch has been published by the vendor; the advisory notes "No known fix" [ref_id=1]. To remediate the vulnerability, the plugin should add a capability check (e.g., current_user_can('activate_plugins')) and a CSRF nonce verification before processing any plugin-deactivation action. Until a patched version is released, site administrators should disable or remove the plugin.
Preconditions
- networkAttacker must be able to send HTTP requests to the WordPress site.
- inputAttacker must know or guess the slug of the plugin they wish to deactivate.
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.