CVE-2026-66642

Overview

Summary

The published record identifies a cross-site request forgery vulnerability affecting WP Umbrella versions 2.24.2 through 2.26.2. The vendor explains that exploitation required a logged-in WordPress administrator to visit a malicious page.

Vulnerability Classification

Security Impact

A successful attacker could cause a logged-in WordPress administrator to submit an unintended request, leading to unauthorized changes through the affected plugin functionality.

Affected Products

WP Umbrella WordPress plugin versions 2.24.2–2.26.2. The default status for the identified version range is affected.

Component: Request routing validation

Fixed version: 2.27.0 or later

Technical Details

The affected request-handling logic could accept a matching string from the raw request URL instead of validating the route resolved by the application. That mismatch allowed a crafted cross-site request to reach state-changing behavior under an authenticated administrator session.

This public record provides enough information to identify the vulnerability and its root cause without unnecessarily publishing weaponized exploit material.

Attack Requirements

• The target must run an affected WP Umbrella version.
• A WordPress administrator must be authenticated.
• The administrator must visit or interact with attacker-controlled content.
• The attacker does not need an authenticated WordPress account.

Remediation

Disclosure Timeline

1. August 4, 2026

   Report submitted

   Anthony Green's report entered Patchstack's managed disclosure process.

2. August 8, 2026

   Vendor independently finds and fixes the issue

   WP Umbrella says its internal audit separately found and fixed the issue before the report reached its team.

3. August 10, 2026

   Fix and advisory published

   WP Umbrella 2.27.0 and the coordinated public CVE record were released.

The vendor describes its internal discovery as independent of the external report. The official CVE record credits Anthony Green [Antnation] as the finder.

Researcher Credit

• Anthony Green [antnation] — Green Hat Security

Coordination and CVE Attribution

Anthony Green submitted the finding through Patchstack's managed disclosure process on August 4, 2026. Patchstack is the assigning CNA for CVE-2026-66642. Green Hat Security participated as the credited researcher and did not reserve or assign the CVE ID.

The vendor describes its internal discovery as independent of the external report. The official CVE record credits Anthony Green [Antnation] as the finder.

References

• Official CVE record ↗
• WP Umbrella disclosure ↗
• Patchstack advisory ↗