# CVE-2026-3565

> Vulnerability · severity: **MEDIUM** (CVSS 4.3).

## Description

The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to a missing nonce verification in the taqnix_delete_my_account() function, where the check_ajax_referer() call is explicitly commented out on line 883. This makes it possible for unauthenticated attackers to trick a logged-in non-administrator user into deleting their own account via a forged request granted they can trick the user into performing an action such as clicking a link or visiting a malicious page.

## Key facts

- **CVE ID:** CVE-2026-3565
- **Published:** 2026-04-24
- **CVSS severity:** MEDIUM
- **CVSS base score:** 4.3
- **CWE codes:** CWE-352

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-3565

## Citation

> AI Analytics. CVE-2026-3565. Retrieved 2026-07-06 from https://api.ai-analytics.org/cve/CVE-2026-3565. Derived from NIST NVD. Licensed CC0.

---

*[Dataset catalog](https://api.ai-analytics.org/datasets/) · [AI Analytics](https://api.ai-analytics.org/) · CC0 1.0*