What is GHSA-hmvr-4f83-5cp7?

GHSA-hmvr-4f83-5cp7 is a security advisory published by GitHub Security Advisories with High severity. The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re...

Which CVE IDs does GHSA-hmvr-4f83-5cp7 cover?

GHSA-hmvr-4f83-5cp7 covers the following CVE IDs: CVE-2026-122003. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hmvr-4f83-5cp7?

GHSA-hmvr-4f83-5cp7 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-hmvr-4f83-5cp7HighCVSS 8.8

The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re...

Vendor

GitHub Security Advisories

Published

November 12, 2026

Last Modified

November 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-122003 →

📋 Description

The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and taking over the site, by tricking them into opening a crafted page (CSRF).

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-122003
https://wpscan.com/vulnerability/e421e862-8d7a-4df6-9c5e-dc06a466a0fc
https://github.com/advisories/GHSA-hmvr-4f83-5cp7