{
 "id": "WPSEC-2026-0592",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0592/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0592/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0592/index.md",
 "title": "All in One Invite Codes <= 1.2.0 - Cross-Site Request Forgery to Invite Code Creation",
 "description": "The All in One Invite Codes plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the invite code creation AJAX action in versions 1.0.6 up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to create an invite code with a value of their choosing under a logged-in user's account, via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.",
 "plugin": {
  "slug": "all-in-one-invite-codes",
  "name": "All in One Invite Codes",
  "full_name": "All in One Invite Codes",
  "wordpress_org": "https://wordpress.org/plugins/all-in-one-invite-codes/",
  "advisories_url": "https://wpsec.com/vuln/plugin/all-in-one-invite-codes/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/all-in-one-invite-codes"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.0.6",
    "from_inclusive": true,
    "to": "1.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.0.6 before 1.3.0"
  ]
 },
 "introduced_in": "1.0.6",
 "fixed_in": "1.3.0",
 "remediation": "Update to 1.3.0 or later.",
 "fix_released": "2026-10-03T19:38:30+00:00",
 "published": "2026-10-07T19:47:10+00:00",
 "updated": "2026-10-07T19:15:15.295344+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0592/",
  "https://plugins.svn.wordpress.org/all-in-one-invite-codes/tags/1.3.0/",
  "https://wordpress.org/plugins/all-in-one-invite-codes/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/all-in-one-invite-codes",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-08"
 }
}