What is the CVSS score of CVE-2026-4090?

CVE-2026-4090 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Inquiry Cart (WordPress plugin) CVE-2026-4090

EUVD-2026-24656 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-22 Wordfence

GHSA-22p7-jgf7-772h

CSRF WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:02 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24656

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.1

DescriptionCVE.org

The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce verification in the rd_ic_settings_page function when processing settings form submissions. This makes it possible for unauthenticated attackers to update the plugin's settings, including injecting malicious scripts that will be stored and executed in the admin area, via a forged request granted they can trick an administrator into performing an action such as clicking on a link.

AnalysisAI

Inquiry Cart plugin for WordPress versions up to 3.4.2 allows unauthenticated attackers to modify plugin settings and inject malicious scripts into the admin area via Cross-Site Request Forgery (CSRF) attacks. The vulnerability exploits missing nonce verification in the settings form handler, requiring an administrator to be socially engineered into clicking a malicious link. Stored scripts execute with admin privileges, enabling account hijacking and complete site compromise.

Technical ContextAI

The Inquiry Cart WordPress plugin processes settings form submissions in the rd_ic_settings_page function without validating WordPress nonce tokens (security identifiers that prevent CSRF attacks). WordPress nonces are cryptographic one-time tokens that bind form submissions to specific users and prevent forged requests. The CWE-352 (Cross-Site Request Forgery) vulnerability occurs because the plugin fails to validate these tokens when updating sensitive configuration, allowing attackers to craft malicious HTML or JavaScript that, when clicked by an authenticated administrator, submits unvalidated settings changes. Since the vulnerability permits script injection into stored settings, any injected payload will execute server-side in the WordPress admin context with full administrative capabilities.

RemediationAI

Update Inquiry Cart plugin to a patched version above 3.4.2 once available from the plugin author or WordPress repository. Until a patch is released, deactivate and deactivate the Inquiry Cart plugin entirely if not actively used. For sites that require the plugin, implement the following compensating controls: (1) restrict access to wp-admin to whitelisted IP addresses using .htaccess or server firewall rules (trade-off: complicates remote administration); (2) enforce strong administrator account credentials and enable WordPress two-factor authentication via security plugins (trade-off: user friction but minimal functional impact); (3) deploy WordPress security plugins (e.g., Wordfence, Sucuri) with CSRF filtering and admin activity monitoring to detect and block malicious settings changes (trade-off: performance overhead and false positives); (4) use Content Security Policy (CSP) headers to restrict inline script execution within the admin dashboard, preventing injected payloads from running (trade-off: may break legitimate admin functionality if misconfigured). Verify resolution via Wordfence vulnerability scanner after patching.