EUVD-2026-24656
GHSA-22p7-jgf7-772h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce verification in the rd_ic_settings_page function when processing settings form submissions. This makes it possible for unauthenticated attackers to update the plugin's settings, including injecting malicious scripts that will be stored and executed in the admin area, via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
AnalysisAI
Inquiry Cart plugin for WordPress versions up to 3.4.2 allows unauthenticated attackers to modify plugin settings and inject malicious scripts into the admin area via Cross-Site Request Forgery (CSRF) attacks. The vulnerability exploits missing nonce verification in the settings form handler, requiring an administrator to be socially engineered into clicking a malicious link. Stored scripts execute with admin privileges, enabling account hijacking and complete site compromise.
Technical ContextAI
The Inquiry Cart WordPress plugin processes settings form submissions in the rd_ic_settings_page function without validating WordPress nonce tokens (security identifiers that prevent CSRF attacks). WordPress nonces are cryptographic one-time tokens that bind form submissions to specific users and prevent forged requests. The CWE-352 (Cross-Site Request Forgery) vulnerability occurs because the plugin fails to validate these tokens when updating sensitive configuration, allowing attackers to craft malicious HTML or JavaScript that, when clicked by an authenticated administrator, submits unvalidated settings changes. Since the vulnerability permits script injection into stored settings, any injected payload will execute server-side in the WordPress admin context with full administrative capabilities.
RemediationAI
Update Inquiry Cart plugin to a patched version above 3.4.2 once available from the plugin author or WordPress repository. Until a patch is released, deactivate and deactivate the Inquiry Cart plugin entirely if not actively used. For sites that require the plugin, implement the following compensating controls: (1) restrict access to wp-admin to whitelisted IP addresses using .htaccess or server firewall rules (trade-off: complicates remote administration); (2) enforce strong administrator account credentials and enable WordPress two-factor authentication via security plugins (trade-off: user friction but minimal functional impact); (3) deploy WordPress security plugins (e.g., Wordfence, Sucuri) with CSRF filtering and admin activity monitoring to detect and block malicious settings changes (trade-off: performance overhead and false positives); (4) use Content Security Policy (CSP) headers to restrict inline script execution within the admin dashboard, preventing injected payloads from running (trade-off: may break legitimate admin functionality if misconfigured). Verify resolution via Wordfence vulnerability scanner after patching.
More in Inquiry Cart
View allSame weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today