CVE-2026-11775: User Admin Simplifier WordPress Plugin CSRF Vulnerability

Technical summary

CVE-2026-11775 is a CSRF vulnerability in the User Admin Simplifier plugin for WordPress affecting all versions through 3.0.0. The vulnerable function useradminsimplifier_options_page fails to properly validate nonces before processing admin option updates via uas_save_admin_options(). An unauthenticated attacker can construct a forged request that overwrites the useradminsimplifier_options database entry, effectively resetting the target administrator's menu configuration and admin-bar settings. The attack vector is network-based, requires user interaction (UI:R), and results in integrity loss rather than confidentiality or availability impact.

Business impact

For WordPress site administrators relying on User Admin Simplifier for customized admin interfaces, a successful attack corrupts saved workflows. Administrators lose their personalized menu layouts and admin-bar configurations, forcing manual reconfiguration. While not a data breach or service outage, the forced reset creates operational friction and can disrupt established administrative routines. Sites with multiple administrators may experience cascade effects if attackers target high-privilege users. The reputational risk is low unless combined with other attacks; the integrity impact is localized to UI preferences rather than content or security settings.

Affected systems

The User Admin Simplifier plugin for WordPress is affected in all versions up to and including 3.0.0. Any WordPress installation running this plugin with an active administrator account is at risk. The attack requires an authenticated administrator to visit a malicious link, so exposure is limited to sites where admins may encounter untrusted content or phishing campaigns. Multisite WordPress installations with shared administrator bases may face broader impact if multiple admins are targeted.

Exploitability

This vulnerability has low to moderate exploitability in practice. While the technical requirements are minimal—no authentication, no special network conditions, straightforward HTTP request—the attack requires successful social engineering. An attacker must convince a site administrator to click a crafted link, typically through phishing, malicious redirects, or trojanized third-party content. The barrier to initial exploitation is trivial, but the barrier to a successful attack chain includes human deception. CVSS 4.3 (Medium) reflects this balance: network-accessible with low complexity, but dependent on user interaction.

Remediation

Update the User Admin Simplifier plugin to a patched version released after 3.0.0. Site administrators should verify the latest available version in the WordPress Plugin Directory and apply the update immediately. Until patching is complete, consider temporarily disabling the plugin if menu and admin-bar customization is not critical. Complement patching with security awareness training to reduce the likelihood that administrators will click malicious links, and consider implementing additional CSRF protections at the site level (e.g., security headers, content security policy).

Patch guidance

Check the User Admin Simplifier plugin page in the WordPress Plugin Directory for version updates released after June 19, 2026. Patches will include proper nonce validation on the useradminsimplifier_options_page function and uas_save_admin_options() handler. Once a patched version is available, use WordPress's built-in plugin update mechanism or manually download and install via the Plugins screen. Test in a staging environment if possible to ensure no conflicts with your site's theme or other plugins. No database migration or configuration changes should be necessary.

Detection guidance

Monitor WordPress admin audit logs (via security plugins or native logging if available) for unexpected changes to user menu and admin-bar settings, particularly if no administrator initiated the change. Look for database logs showing uas_save_admin_options updates without corresponding user actions. Network security teams can detect CSRF attacks by monitoring for unusual POST requests to wp-admin pages from external referrers or missing Referer headers in admin-related requests. Web application firewalls configured for WordPress should flag suspicious admin option modifications. Note that the plugin may not log CSRF attempts, so behavioral anomalies are the primary detection signal.

Why prioritize this

Although the CVSS score is medium (4.3), prioritize patching based on administrator awareness and plugin prevalence at your organization. If User Admin Simplifier is deployed on multiple sites, the aggregate risk increases due to attack surface multiplication. The vulnerability requires only a single successful social engineering attempt per administrator, making it a vector for low-cost, targeted disruption. Patch within your next maintenance window, but do not delay other critical security work. If your organization has security awareness training, use this CVE as a teaching example of CSRF and phishing risks.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects: (1) Network-accessible attack vector with no special conditions; (2) Low attack complexity—straightforward HTTP request, no race conditions or exploit tuning; (3) No privileges required from the attacker; (4) User interaction required—the administrator must click a link; (5) Scope unchanged—the vulnerability does not escape the plugin's security context; (6) Integrity impact (Low)—administrator UI settings are overwritten, not data confidentiality or system availability. The score appropriately downgrades from higher severity due to the mandatory social engineering component and the limited scope of impact (UI configuration only).

Frequently asked questions