CVE-2026-4139

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4139", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-13T15:29:31.027Z", "datePublished": "2026-04-22T07:45:36.467Z", "dateUpdated": "2026-04-22T15:31:40.591Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:36.467Z"}, "affected": [{"vendor": "chsxf", "product": "mCatFilter", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.5.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The mCatFilter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.5.2. This is due to the complete absence of nonce verification and capability checks in the compute_post() function, which processes settings updates. The compute_post() function is called in the plugin constructor on every page load via the plugins_loaded hook, and it directly processes $_POST data to modify plugin settings via update_option() without any CSRF token validation. This makes it possible for unauthenticated attackers to modify all plugin settings, including category exclusion rules, feed exclusion flags, and tag page exclusion flags, via a forged POST request, granted they can trick a site administrator into performing an action such as clicking a link."}], "title": "mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/622ee6c8-7739-44ae-b88f-63a93c0a9b20?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L339"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L339"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L320"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L320"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L138"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L138"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Afnaan"}], "timeline": [{"time": "2026-04-21T19:06:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T15:25:46.505397Z", "id": "CVE-2026-4139", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T15:31:40.591Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4139", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T15:25:46.505397Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T15:25:49.922Z"}}], "cna": {"title": "mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Afnaan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "chsxf", "product": "mCatFilter", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.5.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-21T19:06:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/622ee6c8-7739-44ae-b88f-63a93c0a9b20?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L339"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L339"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L320"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L320"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L138"}, {"url": "https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L138"}], "descriptions": [{"lang": "en", "value": "The mCatFilter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.5.2. This is due to the complete absence of nonce verification and capability checks in the compute_post() function, which processes settings updates. The compute_post() function is called in the plugin constructor on every page load via the plugins_loaded hook, and it directly processes $_POST data to modify plugin settings via update_option() without any CSRF token validation. This makes it possible for unauthenticated attackers to modify all plugin settings, including category exclusion rules, feed exclusion flags, and tag page exclusion flags, via a forged POST request, granted they can trick a site administrator into performing an action such as clicking a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:36.467Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4139", "state": "PUBLISHED", "dateUpdated": "2026-04-22T15:31:40.591Z", "dateReserved": "2026-03-13T15:29:31.027Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-22T07:45:36.467Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "mCatFilter", "vendor": "chsxf", "versions": [{"lessThanOrEqual": "0.5.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The mCatFilter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.5.2. This is due to the complete absence of nonce verification and capability checks in the compute_post() function, which processes settings updates. The compute_post() function is called in the plugin constructor on every page load via the plugins_loaded hook, and it directly processes $_POST data to modify plugin settings via update_option() without any CSRF token validation. This makes it possible for unauthenticated attackers to modify all plugin settings, including category exclusion rules, feed exclusion flags, and tag page exclusion flags, via a forged POST request, granted they can trick a site administrator into performing an action such as clicking a link."}], "id": "CVE-2026-4139", "lastModified": "2026-06-17T10:56:03.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4139", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T15:25:46.505397Z", "version": "2.0.3"}}]}, "published": "2026-04-22T09:16:24.707", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L138"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L320"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L339"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L138"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L320"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L339"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/622ee6c8-7739-44ae-b88f-63a93c0a9b20?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.5.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mCatFilter", "source": "cna", "vendor": "chsxf"}, "product": "mcatfilter", "vendor": "chsxf"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-22T09:52:52.511507+00:00", "value": {"mitigation_remediation": ["Upgrade the mCatFilter plugin to the latest available version (post\u20110.5.2).", "If an upgrade is not possible immediately, configure the site to block administrative POST requests to the plugin\u2019s settings endpoint, for example by adding firewall rules or .htaccess restrictions that limit POST access to admin users only.", "Alternatively, temporarily deactivate the compute_post() hook by editing the plugin\u2019s PHP file to comment out or remove the add_action('plugins_loaded', 'mcatfilter_compute_post'); line, thereby preventing automatic processing of POST data until a patch is applied."], "summary": {"action": "Patch", "impact": "Unauthorized configuration change via CSRF"}, "threat_synthesis": {"affected_systems": "All installations of the mCatFilter plugin for WordPress up to and including version 0.5.2 are affected. Administrators using any WordPress site with these plugin versions are at risk.", "description_and_impact": "The mCatFilter WordPress plugin accepts settings updates through its compute_post() function without any nonce verification or capability checks. The function is called on every page load and processes raw POST data to modify plugin settings via update_option(). Consequently, an unauthenticated attacker can send a forged POST request that a site administrator unknowingly executes, allowing the attacker to alter plugin settings such as category exclusions, feed flags, and tag page exclusions. The impact is the compromise of the plugin\u2019s configuration integrity, which can affect content visibility and site functionality.", "risk_and_exploitability": "This vulnerability carries a CVSS score of 4.3, indicating medium severity. EPSS information is not available, so the exploitation probability cannot be quantified. The issue is not listed in the CISA KEV catalog. The likely attack requires a victim administrator to click a malicious link that submits a crafted POST request; thus the attack vector is web-based user interaction. While it does not provide remote code execution, the ability to hijack configuration settings can lead to unintentional content exclusion, possible compliance violations, and reduced control over the site\u2019s behavior."}}}}, "created": "2026-04-22T10:00:10.250373+00:00", "updated": "2026-04-22T11:44:07.812380+00:00", "vendors": ["chsxf", "chsxf$PRODUCT$mcatfilter", "wordpress", "wordpress$PRODUCT$wordpress"]}