CVE-2026-8424: Remove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery
The Remove Yellow BGBOX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'rybb_api_settings' page. This makes it possible for unauthenticated attackers to reset the plugin's stored settings by overwriting its configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8424?
CVE-2026-8424 has a moderate severity level due to the potential for Cross-Site Request Forgery.
How do I fix CVE-2026-8424?
To fix CVE-2026-8424, update the Remove Yellow BGBOX plugin to a version greater than 1.0 that includes proper nonce validation.
What types of systems are affected by CVE-2026-8424?
CVE-2026-8424 affects WordPress sites using the Remove Yellow BGBOX plugin version 1.0 or earlier.
What kind of attacks can CVE-2026-8424 result in?
CVE-2026-8424 can lead to unauthorized actions being performed on behalf of users without their consent.
Is there a way to prevent exploitation of CVE-2026-8424 until I can update?
While waiting to update, you can restrict access to the 'rybb_api_settings' page to trusted users only.