[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fk7CtSQrrognRgaFtafxXAgEyn8D7siN_r5ET2TvyVf0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2026-6452","bigfishgames-syndicate-cross-site-request-forgery-to-settings-reset-and-update","Bigfishgames Syndicate \u003C= 1.2 - Cross-Site Request Forgery to Settings Reset and Update","The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the bigfishgames_syndicate_submenu() function. This makes it possible for unauthenticated attackers to reset plugin settings and update them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","bigfishgames-syndicate",null,"\u003C=1.2","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2026-05-19 12:05:23","2026-05-20 01:25:49",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F67877a2e-a45d-4674-b749-05d9217ef6bf?source=api-prod",[],"researched",false,3,"I cannot fulfill your request. I am prohibited from generating detailed exploitation plans, actionable payloads, or specific instructions for bypassing security measures in software. If you are interested in learning about how to defend against these types of vulnerabilities, I recommend searching for resources on \"WordPress CSRF protection best practices\" and \"proper implementation of WordPress nonces\" through official WordPress developer documentation and established security research platforms.","The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 1.2. This vulnerability allows an unauthenticated attacker to reset or update plugin settings by tricking a site administrator into clicking a malicious link or submitting a forged form.","\u002F\u002F From bigfishgames-syndicate.php\nfunction bigfishgames_syndicate_submenu() {\n    if (isset($_POST['submit'])) {\n        \u002F\u002F The code processes settings updates directly from $_POST without verifying a nonce\n        update_option('bfg_syndicate_id', $_POST['bfg_syndicate_id']);\n        update_option('bfg_syndicate_format', $_POST['bfg_syndicate_format']);\n        \u002F\u002F ... other settings updates ...\n    }\n    \u002F\u002F ... (rest of the function rendering the form) ...\n}","--- bigfishgames-syndicate.php\n+++ bigfishgames-syndicate.php\n@@ -10,6 +10,7 @@\n function bigfishgames_syndicate_submenu() {\n-    if (isset($_POST['submit'])) {\n+    if (isset($_POST['submit'])) {\n+        check_admin_referer('bfg_syndicate_update_settings');\n         update_option('bfg_syndicate_id', $_POST['bfg_syndicate_id']);\n@@ -25,4 +26,5 @@\n     \u003Cform method=\"post\" action=\"\">\n+        \u003C?php wp_nonce_field('bfg_syndicate_update_settings'); ?>\n         \u003Cinput type=\"text\" name=\"bfg_syndicate_id\" value=\"\u003C?php echo get_option('bfg_syndicate_id'); ?>\" \u002F>\n         \u003Cinput type=\"submit\" name=\"submit\" value=\"Save Settings\" \u002F>\n     \u003C\u002Fform>","The exploit targets the settings page of the Bigfishgames Syndicate plugin. Since the plugin fails to implement WordPress nonces for request verification, an attacker can create a hidden HTML form on an external site. This form is configured to POST to the WordPress admin panel (typically `\u002Fwp-admin\u002Foptions-general.php?page=bigfishgames-syndicate`) with parameters representing the desired malicious settings (e.g., changing IDs or formats). If an authenticated administrator visits the attacker's page, the browser automatically sends the POST request along with the administrator's session cookies, causing the plugin to update its configuration according to the attacker's payload.","gemini-3-flash-preview","2026-05-20 17:00:11","2026-05-20 17:00:36",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbigfishgames-syndicate\u002Ftags"]