Description

Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:16:53.377Z",
  "pubdate": "2026-08-06T15:16:53.377Z",
  "executiveSummary": "An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability exists in the Tracking Code Manager plugin for WordPress, affecting all versions up to and including 2.6.0. This security flaw enables remote attackers to trick authenticated administrative users into executing unauthorized state-changing actions without their explicit consent or knowledge.\nThe vulnerability exposes the affected system to severe administrative compromise by allowing malicious actors to manipulate tracking codes, inject arbitrary scripts, or perform other privileged operations contingent upon the victim's session. Exploitation requires an unauthenticated attacker to successfully deliver a crafted exploit payload to a targeted user with administrative privileges, typically via social engineering vectors such as malicious links or crafted web pages.\nThe risk implication is high, as successful exploitation can lead to persistent cross-site scripting (XSS), malicious code injection into website headers or footers, and subsequent compromise of site visitors. Mitigation necessitates updating the Tracking Code Manager plugin beyond version 2.6.0 or applying vendor-supplied patches as soon as they become available.",
  "technicalDetails": "The vulnerability stems from the absence of robust anti-CSRF tokens, such as cryptographic nonces, within the state-changing request handlers of the Tracking Code Manager plugin. Because the application fails to validate the origin of incoming HTTP requests or verify user intent through session-tied validation tokens, external domains can forge requests on behalf of an authenticated administrator.\nThe affected component involves the request handling functions responsible for processing administrative configurations and tracking code insertions within versions <= 2.6.0 of the Tracking Code Manager. The network exposure is remote, and authentication is technically bypassed from the attacker's perspective because the victim's authenticated browser implicitly attaches valid session cookies to the forged cross-site request.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts a malicious HTML page or script containing a forged HTTP request targeted at the administrative endpoints of the vulnerable WordPress site utilizing Tracking Code Manager. 2) The attacker lures an authenticated administrator into visiting the malicious resource via phishing or watering-hole techniques. 3) The victim's browser automatically includes valid session cookies when dispatching the cross-origin request to the vulnerable application. 4) The server processes the request, assuming legitimate administrative intent due to the valid session context, and executes the unauthorized modifications, such as injecting malicious tracking scripts.\nPost-exploitation impact includes the persistent injection of malicious JavaScript into pages served by the WordPress instance, enabling session hijacking, redirection of traffic to malicious destinations, or defacement of the affected web application."
}