What is the CVSS score of CVE-2026-4091?

CVE-2026-4091 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4091

EUVD-2026-22870 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-15 Wordfence

GHSA-frwx-4qvw-g6ww

WordPress CSRF

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 09:09 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 09:00 euvd

EUVD-2026-22870

Analysis Generated

Apr 15, 2026 - 09:00 vuln.today

CVE Published

Apr 15, 2026 - 08:28 nvd

MEDIUM 6.1

DescriptionCVE.org

The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.0. This is due to missing nonce verification on the settings form in the func_page_main() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery (CSRF) in OPEN-BRAIN plugin for WordPress versions up to 0.5.0 allows unauthenticated attackers to inject malicious web scripts by tricking site administrators into clicking a malicious link, due to missing nonce verification in the func_page_main() settings form handler. With a CVSS score of 6.1 and network-level attack surface requiring only user interaction, this vulnerability affects any WordPress installation using the affected plugin. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The OPEN-BRAIN WordPress plugin (CPE: cpe:2.3:a:faridsaniee:open-brain:*:*:*:*:*:*:*:*) implements a settings form in the func_page_main() function that processes administrative configuration changes without validating WordPress nonce tokens. WordPress nonces are cryptographic tokens designed to prevent CSRF attacks by ensuring that state-changing requests originate from legitimate, authenticated sessions. The root cause is CWE-352 (Cross-Site Request Forgery), a class-level vulnerability where sensitive operations lack anti-CSRF protections. By omitting nonce verification via wp_verify_nonce(), the plugin allows attackers to craft cross-origin POST requests that execute administrative actions (such as modifying plugin settings) when a logged-in administrator visits a malicious webpage controlled by the attacker.

RemediationAI

The primary remediation is to update the OPEN-BRAIN plugin to a version newer than 0.5.0 as soon as the plugin author releases a patched version incorporating nonce verification via WordPress's wp_verify_nonce() or wp_nonce_field() functions in the settings form. As an interim workaround, site administrators should restrict access to the WordPress administrative panel to trusted IP ranges via .htaccess or web application firewall rules, limiting the ability for attackers to trick administrators into visiting malicious sites that could trigger the CSRF. Additionally, consider disabling the OPEN-BRAIN plugin entirely if it is not critical to site operations, and monitor the plugin's official repository (https://plugins.trac.wordpress.org/browser/open-brain/) for updates. Review Wordfence's detailed analysis for implementation guidance.