CVE-2026-7047

Vulnerability

The Frontend User Notes plugin for WordPress, in all versions up to and including 2.1.1, suffers from a Cross-Site Request Forgery (CSRF) vulnerability. This is due to insufficient nonce validation within the funp_ajax_modify_notes function, which is accessible via AJAX requests.

Exploitation

An unauthenticated attacker can exploit this vulnerability by tricking a logged-in user, particularly a site administrator, into visiting a malicious webpage. This webpage would contain a forged cross-site request targeting the funp_ajax_modify_notes function, causing the victim's browser to send the request to the WordPress site.

Impact

Successful exploitation allows an attacker to overwrite the content of a victim's own note. The vulnerability is limited by ownership enforcement, meaning an attacker can only modify notes belonging to the tricked user and cannot alter notes owned by other users.

Mitigation

There is no specific mitigation or patched version information available in the provided references. Users are advised to monitor the plugin for updates. The plugin's source code can be reviewed at [1] and [2].