EUVD-2026-24680
GHSA-9p67-72c6-m54h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The mCatFilter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.5.2. This is due to the complete absence of nonce verification and capability checks in the compute_post() function, which processes settings updates. The compute_post() function is called in the plugin constructor on every page load via the plugins_loaded hook, and it directly processes $_POST data to modify plugin settings via update_option() without any CSRF token validation. This makes it possible for unauthenticated attackers to modify all plugin settings, including category exclusion rules, feed exclusion flags, and tag page exclusion flags, via a forged POST request, granted they can trick a site administrator into performing an action such as clicking a link.
AnalysisAI
Cross-site request forgery in mCatFilter WordPress plugin up to version 0.5.2 allows unauthenticated attackers to modify all plugin settings including category exclusion rules, feed exclusion flags, and tag page exclusion flags by tricking site administrators into clicking a malicious link. The vulnerability exists because the compute_post() function processes $_POST data without nonce verification or capability checks, executing on every page load via the plugins_loaded hook.
Technical ContextAI
The mCatFilter plugin (CPE: cpe:2.3:a:chsxf:mcatfilter:*:*:*:*:*:*:*:*) contains a CSRF vulnerability rooted in CWE-352 (Cross-Site Request Forgery). The compute_post() function, invoked during plugin initialization via the plugins_loaded hook, directly processes superglobal $_POST data and calls update_option() to persist settings changes without validating WordPress nonce tokens or verifying user capabilities. This occurs on every page load when the plugin is active, meaning any forged POST request from an external site can modify plugin configuration if a logged-in administrator visits that site while the WordPress session is active.
RemediationAI
Update mCatFilter to version 0.5.3 or later if available from the official WordPress plugin repository. As an immediate compensating control, disable the mCatFilter plugin until an update is deployed, or restrict WordPress administrator access to trusted networks only using firewall or .htaccess rules to reduce the likelihood of successful social engineering attacks targeting administrators. If the plugin cannot be updated, review plugin settings (category exclusion, feed exclusion, tag page exclusion flags) in the WordPress admin panel and document the intended configuration, then monitor for unexpected changes via database audit logs or WordPress debug logs. Note that disabling the plugin eliminates its content filtering functionality, so organizations must weigh this against the CSRF risk. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/622ee6c8-7739-44ae-b88f-63a93c0a9b20?source=cve) provides additional guidance and may include details on patched version availability.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today