PatchSiren cyber security CVE debrief
CVE-2026-8708 shra CVE debrief
The Genzel breadcrumbs plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.2. The vulnerability stems from missing or incorrect nonce validation on the `_options_page` function, allowing unauthenticated attackers to modify the plugin's breadcrumb configuration—including templates, delimiter, home label, home URI, and breadcrumb rules—via a forged request if they can trick a site administrator into clicking a malicious link. This vulnerability was disclosed on 2026-05-27 and has been assigned a CVSS 3.1 score of 4.3 (Medium severity). The weakness is classified as CWE-352 (Cross-Site Request Forgery).
- Vendor
- shra
- Product
- Genzel breadcrumbs
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-27
Who should care
WordPress site administrators using the Genzel breadcrumbs plugin, security teams managing WordPress deployments, and web application security professionals responsible for plugin security assessments.
Technical summary
The Genzel breadcrumbs WordPress plugin (≤1.2) contains a CSRF vulnerability in the `_options_page` function due to improper nonce validation. Attackers can forge requests to modify breadcrumb settings including templates, delimiter, home label, home URI, and rules. Exploitation requires social engineering an authenticated administrator. CVSS 4.3 (Medium). Not in CISA KEV.
Defensive priority
medium
Recommended defensive actions
- Update the Genzel breadcrumbs plugin to a version newer than 1.2 if available, or remove the plugin if updates are not forthcoming.
- Implement additional CSRF protections at the web application firewall (WAF) level for WordPress administrative endpoints.
- Educate site administrators about the risks of clicking untrusted links while logged into WordPress admin panels.
- Monitor for unauthorized changes to breadcrumb configuration as potential indicators of exploitation attempts.
- Consider implementing Content Security Policy (CSP) headers and SameSite cookie attributes to mitigate CSRF attack vectors.
Evidence notes
The vulnerability was reported by Wordfence and is documented in the NVD with references to specific source code locations in the Genzel breadcrumbs plugin. The affected function `_options_page` in `gb.class.php` fails to properly validate nonces, as evidenced by the referenced lines in the WordPress plugin repository. The `page-options.php` file at line 16 is also implicated in the vulnerable code path.
Official resources
2026-05-27