CVE-2026-4090

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4090", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-12T21:14:19.934Z", "datePublished": "2026-04-22T07:45:37.529Z", "dateUpdated": "2026-04-22T15:59:46.866Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:37.529Z"}, "affected": [{"vendor": "ravster", "product": "Inquiry cart", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce verification in the rd_ic_settings_page function when processing settings form submissions. This makes it possible for unauthenticated attackers to update the plugin's settings, including injecting malicious scripts that will be stored and executed in the admin area, via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "title": "Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/772e9b2b-b2d5-4950-804b-d0914004710c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L46"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L46"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L6"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L6"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L21"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L21"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L47"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L47"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L48"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L48"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L49"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L49"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/inquiry-cart-shortcode.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/inquiry-cart-shortcode.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/inquiry-cart-shortcode.php#L34"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/inquiry-cart-shortcode.php#L34"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-04-21T19:08:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T15:53:03.311078Z", "id": "CVE-2026-4090", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T15:59:46.866Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4090", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T15:53:03.311078Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T15:53:07.550Z"}}], "cna": {"title": "Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ravster", "product": "Inquiry cart", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.4.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-21T19:08:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/772e9b2b-b2d5-4950-804b-d0914004710c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L46"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L46"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L6"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L6"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L21"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L21"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L47"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L47"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L48"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L48"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L49"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L49"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/inquiry-cart-shortcode.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/inquiry-cart-shortcode.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/inquiry-cart-shortcode.php#L34"}, {"url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/inquiry-cart-shortcode.php#L34"}], "descriptions": [{"lang": "en", "value": "The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce verification in the rd_ic_settings_page function when processing settings form submissions. This makes it possible for unauthenticated attackers to update the plugin's settings, including injecting malicious scripts that will be stored and executed in the admin area, via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:37.529Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4090", "state": "PUBLISHED", "dateUpdated": "2026-04-22T15:59:46.866Z", "dateReserved": "2026-03-12T21:14:19.934Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-22T07:45:37.529Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Inquiry cart", "vendor": "ravster", "versions": [{"lessThanOrEqual": "3.4.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce verification in the rd_ic_settings_page function when processing settings form submissions. This makes it possible for unauthenticated attackers to update the plugin's settings, including injecting malicious scripts that will be stored and executed in the admin area, via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "id": "CVE-2026-4090", "lastModified": "2026-06-17T10:55:58.593", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4090", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T15:53:03.311078Z", "version": "2.0.3"}}]}, "published": "2026-04-22T09:16:22.867", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/inquiry-cart-shortcode.php#L32"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/inquiry-cart-shortcode.php#L34"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L21"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L46"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L47"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L48"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L49"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L6"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/inquiry-cart-shortcode.php#L32"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/inquiry-cart-shortcode.php#L34"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L21"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L46"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L47"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L48"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L49"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L6"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/772e9b2b-b2d5-4950-804b-d0914004710c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.4.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Inquiry cart", "source": "cna", "vendor": "ravster"}, "product": "inquiry_cart", "vendor": "ravster"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-22T09:24:25.984667+00:00", "value": {"mitigation_remediation": ["Upgrade the Inquiry Cart plugin to the latest version that includes nonce verification.", "If an upgrade is not possible, disable or delete the plugin\u2019s settings page to prevent unauthorized changes.", "Restrict access to the WordPress admin area to trusted roles and enable two\u2011factor authentication to reduce the success of CSRF attempts."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Request Forgery leading to arbitrary script injection in the WordPress admin area"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Inquiry Cart WordPress plugin from Ravenster, specifically versions 3.4.2 and earlier. Site administrators using these older releases are at risk.", "description_and_impact": "Missing nonce verification in the plugin\u2019s settings form allows an attacker who can trick an administrator into clicking a crafted link to submit forged requests. This upload of arbitrary data can change configuration options and inject malicious scripts that will run when the admin page is loaded, giving the attacker a foothold in the site\u2019s privileged backend.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a medium severity. No EPSS score is available, and the issue is not listed in CISA\u2019s KEV catalog, implying it is not a widely exploited known vulnerability. Attackers need to lure an administrator into clicking a malicious link or inserting a forged form request, which is a commonly exploited CSRF pattern. Because the plugin stores the attacker\u2019s payload, any subsequent interaction with the plugin\u2019s admin pages will execute the injected code, potentially leading to full admin compromise."}}}}, "created": "2026-04-22T09:30:13.554117+00:00", "updated": "2026-04-22T09:45:12.956456+00:00", "vendors": ["ravster", "ravster$PRODUCT$inquiry_cart", "wordpress", "wordpress$PRODUCT$wordpress"]}