WisdmLabs Edwiser Bridge: Cross-Site Request Forgery in WordPress plugin

Summary

The Edwiser Bridge WordPress plugin up to and including version 4.3.4 contains a Cross-Site Request Forgery (CSRF) flaw. An attacker can trick a logged-in user, for example an administrator, into performing actions on the site without intent by luring them to a malicious page or link. The attack requires user interaction; the CNA rates the impact as high for confidentiality, integrity and availability, while Patchstack rates it as low priority.

Affected

• Edwiser Bridge WordPress plugin: all versions up to and including 4.3.4
• Lower bound of the affected range is not specified in the CVE record (shown as 0)

Fixed in

• Version 4.3.5 or later

Workaround

Unknown. No vendor workaround found in the sources. Update to 4.3.5 or later.

Exploitation

• OffSeq lists the vulnerability as not known to be exploited
• No public proof of concept or Metasploit module was found in the research; Exploit-DB, GitHub and CISA KEV were not checked directly

Our recommendation

• Find all sites running Edwiser Bridge and check the installed version
• Update to version 4.3.5 or later, testing on a staging system first
• Limit administrator accounts to those who need them and have administrators log out when not working in WordPress
• Review administrator accounts and sessions for unexpected changes
• Monitor the Patchstack record and the vendor changelog for updates

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack vulnerability advisory patchstack.com
• CVE Record CVE-2026-125446 www.cve.org
• OffSeq threat radar entry radar.offseq.com
• WordPress.org plugin listing (Edwiser Bridge) en-ca.wordpress.org
• Vendor source repository (WisdmLabs) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:21.