Atomic Edge analysis of CVE-2026-1072:
This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the Keybase.io Verification WordPress plugin, affecting versions up to and including 1.4.5. The vulnerability allows unauthenticated attackers to modify the plugin’s verification text settings by tricking an administrator into submitting a forged request. The CVSS score of 4.3 reflects a medium severity impact.

Atomic Edge research identifies the root cause as missing nonce validation in the settings update handler. The vulnerable code resides in the file `wp-keybase-verification/admin/code/write.php`. The `if (isset($_POST[‘keybaseverif_text’]))` conditional at line 49 processes form submissions without verifying a nonce token. This omission allows any POST request containing the `keybaseverif_text` parameter to update the `keybaseverif_text` option via the `update_option()` function.

Exploitation requires an attacker to craft a malicious web page or link that submits a forged POST request to the plugin’s settings page. The target endpoint is `options-general.php?page={page}`, where `{page}` corresponds to the plugin’s admin menu slug. The payload consists of a single parameter, `keybaseverif_text`, containing the attacker’s desired verification text. An attacker must induce a logged-in administrator to load the malicious page, which then silently submits the form to the vulnerable endpoint.

The patch adds nonce verification to the form processing logic. In `wp-keybase-verification/admin/code/write.php`, the patch inserts `check_admin_referer(‘keybaseverif_save’, ‘keybaseverif_nonce’);` at line 51, immediately after the `isset()` check. This function validates the presence and correctness of a WordPress nonce. The corresponding fix in `wp-keybase-verification/admin/html/write.php` adds “ to the form, generating the required security token. These changes ensure that form submissions originate from the intended plugin admin page.

Successful exploitation allows an attacker to alter the Keybase verification text stored in the WordPress database. This could disrupt or falsify the site’s claimed Keybase identity, potentially damaging trust or enabling impersonation attacks. The attack requires administrator interaction, but no authentication or special privileges are needed for the request itself. The impact is limited to modification of the plugin’s specific setting, not arbitrary code execution or full site compromise.