CVE-2025-14167
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Feb 19, 2026
CISA due date
—
The record
The Remove Post Type Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to incorrect nonce validation logic that uses OR (||) instead of AND (&&), causing the validation to fail when the nonce field is not empty OR when verification fails, rather than when it's empty AND verification fails. This makes it possible for unauthenticated attackers to modify the plugin's post type slug removal settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96388 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application… CWE-352
- CVE-2026-96374 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross… CWE-352
- CVE-2026-114719 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation… CWE-352
- CVE-2026-114662 Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow… CWE-352
- CVE-2026-111883 Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows… CWE-352
- CVE-2026-62139 Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0… CWE-352
- CVE-2026-62133 Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. CWE-352
- CVE-2026-89245 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site… CWE-352