CVE-2026-6391 — The Sentence To SEO (keywords, description and tags) plugin

title: WordPress Sentence To SEO Plugin CSRF to Admin Page Update — CVE-2026-6391
id: scw-2026-05-20-ai-1
status: experimental
level: high
description: |
  Detects a Cross-Site Request Forgery (CSRF) attack targeting the Sentence To SEO plugin in WordPress. This rule specifically looks for POST requests to the WordPress admin page that include parameters indicative of the vulnerable `create_admin_page()` function, which lacks proper nonce validation. This could allow an unauthenticated attacker to inject malicious scripts or alter plugin settings by tricking an administrator into clicking a crafted link.
author: SCW Feed Engine (AI-generated)
date: 2026-05-20
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6391/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin.php'
      cs-uri-query|contains:
          - 'page=sentence-to-seo/admin/admin.php'
      cs-uri-query|contains:
          - 'action=create_admin_page'
      cs-method:
          - 'POST'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse