CVE detail
CVE-2026-9599
The Tectite Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the admin_init function. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the tectite_forms_button option, via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 17.9 · diversity 11.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
5 source links · newest first
- Wordfence Intelligence Weekly WordPress Vulnerability Report (June 1, 2026 to June 7, 2026)Wordfence
6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-8206 Patch Status Patched Published Jun 1, 2026 Affected Software Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] Researcher CHOIGYEONGMIN More Details > Multiple ShapedPlugin Plugins Support Board Gravit
vendorwww.wordfence.comJun 11, 2026, 5:13 PM - https://www.wordfence.com/threat-intel/vulnerabilities/id/965b6a19-3e5f-446c-a739-746e886a5585?source=cvewww.wordfence.com
No excerpt available.
Patchwww.wordfence.comJun 2, 2026, 9:16 AM - https://plugins.trac.wordpress.org/browser/tectite-forms/tags/1.3/views/admin.php#L49plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 2, 2026, 9:16 AM - https://plugins.trac.wordpress.org/browser/tectite-forms/tags/1.3/php/class-tectite-forms.php#L56plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 2, 2026, 9:16 AM - https://plugins.trac.wordpress.org/browser/tectite-forms/tags/1.3/php/class-tectite-forms.php#L55plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 2, 2026, 9:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-73162CVSS 5.3 · Medium
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_notification * /ac…
- CVE-2026-19418CVSS 7.3 · High
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool ap…
- CVE-2026-66775CVSS 4.3 · Medium
SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a vi…
- CVE-2025-32736CVSS 4.9 · Medium
Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-cra…
- CVE-2026-72578CVSS 8.8 · High
A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticat…
- CVE-2026-66642CVSS 5.4 · Medium
Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2.