CVE-2023-6946 is a CSRF flaw in the Autotitle for WordPress plugin through version 1.0.3. The record scores it 8.8 (High), while WPScan scores it 7.1 (High) and describes it as a settings update leading to stored XSS. WPScan lists no known fix, so remove the plugin.
What's affected
The record lists Autotitle for WordPress through version 1.0.3. WPScan says there is no known fix. The two sources differ on the score: the NVD record gives CVSS 8.8, and WPScan gives 7.1. Both rate it High, and this post reports both numbers.
WPScan titles the entry as a settings update that leads to stored XSS through CSRF. A logged-in administrator who is tricked into loading a hostile page can have the plugin settings changed.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get autotitle-for-wordpress --field=version
Any installed copy is affected, since no fixed release is listed. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
What to do now
- Deactivate and delete the plugin. WPScan lists no fix.
- Review the plugin's saved settings and your pages for unexpected script content before you remove it.
- Administrators should log out of the dashboard when browsing other sites, and use a separate browser profile for admin work.
- Choose a maintained plugin if you need the feature.
Why it matters
The description says the plugin has no CSRF check when updating its settings. WPScan adds that the settings can carry stored script content, which turns a forged request into a persistent cross-site scripting issue. The record tags CWE-352.
Cross-site request forgery works because the browser attaches a logged-in user's cookies to every request, including ones started by another site. If a settings form does not require a secret token that only the real page knows, a third-party page can cause the logged-in user's browser to submit it. The attacker never needs the password, only a moment of the victim's attention.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Weakness class in the record: CWE-352 (Cross-Site Request Forgery).
Quick check
What makes a CSRF flaw turn into XSS?
If the forged settings can hold script content that the plugin later prints on pages, the one-time forged request leaves a lasting payload that runs for every visitor.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
