Mcatfilter
Monthly
Cross-site request forgery in mCatFilter WordPress plugin up to version 0.5.2 allows unauthenticated attackers to modify all plugin settings including category exclusion rules, feed exclusion flags, and tag page exclusion flags by tricking site administrators into clicking a malicious link. The vulnerability exists because the compute_post() function processes $_POST data without nonce verification or capability checks, executing on every page load via the plugins_loaded hook.
Cross-site request forgery in mCatFilter WordPress plugin up to version 0.5.2 allows unauthenticated attackers to modify all plugin settings including category exclusion rules, feed exclusion flags, and tag page exclusion flags by tricking site administrators into clicking a malicious link. The vulnerability exists because the compute_post() function processes $_POST data without nonce verification or capability checks, executing on every page load via the plugins_loaded hook.