{"affected":[{"defaultStatus":"unaffected","product":"Abilities Bridge","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.4.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-122003","cwes":["CWE-352"],"description":"The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and taking over the site, by tricking them into opening a crafted page (CSRF).","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/e421e862-8d7a-4df6-9c5e-dc06a466a0fc/"}],"kev":null,"metrics":[],"modifiedAt":1794463208273,"publishedAt":1794463208273,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/e421e862-8d7a-4df6-9c5e-dc06a466a0fc/"}],"remediation":[],"revision":"cde0337ccff67d22ba82200966369c97762f63be04067ba45775ff5fbfb15951","sources":[{"modifiedAt":1794463208273,"name":"CNA: WPScan","retrievedAt":1794467314313,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122003"}],"ssvc":null,"status":"published","title":"Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF","updatedAt":1794467314313}