WordPress Plugin Vulnerabilities

teachPress < 9.0.13 - Cross-Site Request Forgery

Description

The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.0.12. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
teachpress
Fixed in 9.0.13

References

CVE
CVE-2026-22483
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b6aa4ad3-a0f0-4917-acaf-2f683aecba3e

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nabil Irawan
Verified
No
WPVDB ID
baed7217-12f8-4f18-827d-22882ff0f86c

Timeline

Publicly Published
2026-01-06 (about 5 months ago)
Added
2026-01-14 (about 5 months ago)
Last Updated
2026-04-15 (about 2 months ago)

Other

Published
Title
Published
2025-05-07
Title
Web Accessibility with Max Access < 2.1.0 - Cross-Site Request Forgery
Published
2024-11-01
Title
Custom Author URL <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-03-01
Title
Master Slider < 3.10.0 - Sliders Deletion via CSRF
Published
2025-12-31
Title
Appointify <= 1.0.8 - Cross-Site Request Forgery
Published
2024-06-04
Title
Mollie Forms < 2.6.14 - Cross-Site Request Forgery to Arbitrary Post Duplication