PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11775 adamsilverstein CVE debrief

The User Admin Simplifier plugin for WordPress has a Cross-Site Request Forgery vulnerability in all versions up to, and including, 3.0.0. This vulnerability, with a CVSS score of 4.3, allows unauthenticated attackers to reset and permanently delete any user's stored menu and admin-bar configuration via a forged request. The vulnerability exists due to missing or incorrect nonce validation on the useradminsimplifier_options_page function, enabling attackers to trick site administrators into performing actions like clicking on a link to overwrite the useradminsimplifier_options database entry.

Vendor
adamsilverstein
Product
User Admin Simplifier
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-19
Original CVE updated
2026-06-22
Advisory published
2026-06-19
Advisory updated
2026-06-22

Who should care

Administrators of WordPress sites using the User Admin Simplifier plugin, especially those with versions up to 3.0.0, should be aware of this vulnerability. Site owners and security teams need to assess the risk and apply necessary patches or mitigations to prevent exploitation.

Technical summary

The vulnerability in the User Admin Simplifier plugin for WordPress is caused by inadequate nonce validation in the useradminsimplifier_options_page function. This allows unauthenticated attackers to execute Cross-Site Request Forgery attacks, potentially leading to unauthorized modifications of user configurations. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N indicates a medium severity vulnerability that requires user interaction but can lead to low integrity impacts.

Defensive priority

High

Recommended defensive actions

  • Update the User Admin Simplifier plugin to a version beyond 3.0.0 if available.
  • Implement additional monitoring for suspicious requests to the useradminsimplifier_options_page function.
  • Educate site administrators on the risks of clicking on unverified links.
  • Consider implementing a Web Application Firewall (WAF) to detect and block CSRF attacks.
  • Regularly review and update plugins and themes to ensure they are up-to-date and patched.
  • Use security headers like SameSite cookies to enhance protection against CSRF attacks.

Evidence notes

The information provided is based on data from the National Vulnerability Database (NVD) and Wordfence security research. The vulnerability details and CVSS score were obtained from these trusted sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11775 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11775

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11775 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11775

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.