Vulnerabilities / All in One Invite Codes / WPSEC-2026-0592
All in One Invite Codes <= 1.2.0 - Cross-Site Request Forgery to Invite Code Creation
Medium 4.3
CWE-352Fixed in 1.3.0
- ID
- WPSEC-2026-0592
- Plugin
- All in One Invite Codes (all-in-one-invite-codes)
- Affected
- from 1.0.6 before 1.3.0
- Remediation
- Update to 1.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-08
- Attack surface
- All in One Invite Codes on WPSec AttackSurface
- Fix released
- Published
Description
The All in One Invite Codes plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the invite code creation AJAX action in versions 1.0.6 up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to create an invite code with a value of their choosing under a logged-in user's account, via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-0592/
- https://plugins.svn.wordpress.org/all-in-one-invite-codes/tags/1.3.0/
- https://wordpress.org/plugins/all-in-one-invite-codes/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS