What is the CVSS score of CVE-2026-4139?

CVE-2026-4139 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

mCatFilter WordPress Plugin CVE-2026-4139

EUVD-2026-24680 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-22 Wordfence

GHSA-9p67-72c6-m54h

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:01 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24680

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.3

DescriptionCVE.org

The mCatFilter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.5.2. This is due to the complete absence of nonce verification and capability checks in the compute_post() function, which processes settings updates. The compute_post() function is called in the plugin constructor on every page load via the plugins_loaded hook, and it directly processes $_POST data to modify plugin settings via update_option() without any CSRF token validation. This makes it possible for unauthenticated attackers to modify all plugin settings, including category exclusion rules, feed exclusion flags, and tag page exclusion flags, via a forged POST request, granted they can trick a site administrator into performing an action such as clicking a link.

AnalysisAI

Cross-site request forgery in mCatFilter WordPress plugin up to version 0.5.2 allows unauthenticated attackers to modify all plugin settings including category exclusion rules, feed exclusion flags, and tag page exclusion flags by tricking site administrators into clicking a malicious link. The vulnerability exists because the compute_post() function processes $_POST data without nonce verification or capability checks, executing on every page load via the plugins_loaded hook.

Technical ContextAI

The mCatFilter plugin (CPE: cpe:2.3:a:chsxf:mcatfilter:*:*:*:*:*:*:*:*) contains a CSRF vulnerability rooted in CWE-352 (Cross-Site Request Forgery). The compute_post() function, invoked during plugin initialization via the plugins_loaded hook, directly processes superglobal $_POST data and calls update_option() to persist settings changes without validating WordPress nonce tokens or verifying user capabilities. This occurs on every page load when the plugin is active, meaning any forged POST request from an external site can modify plugin configuration if a logged-in administrator visits that site while the WordPress session is active.

RemediationAI

Update mCatFilter to version 0.5.3 or later if available from the official WordPress plugin repository. As an immediate compensating control, disable the mCatFilter plugin until an update is deployed, or restrict WordPress administrator access to trusted networks only using firewall or .htaccess rules to reduce the likelihood of successful social engineering attacks targeting administrators. If the plugin cannot be updated, review plugin settings (category exclusion, feed exclusion, tag page exclusion flags) in the WordPress admin panel and document the intended configuration, then monitor for unexpected changes via database audit logs or WordPress debug logs. Note that disabling the plugin eliminates its content filtering functionality, so organizations must weigh this against the CSRF risk. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/622ee6c8-7739-44ae-b88f-63a93c0a9b20?source=cve) provides additional guidance and may include details on patched version availability.