Cross-Site Request Forgery Vulnerability in Inquiry Cart Plugin for WordPress

CVE-2026-4090

What is CVE-2026-4090?

The Inquiry Cart plugin for WordPress contains a Cross-Site Request Forgery vulnerability that affects all versions up to and including 3.4.2. Due to a lack of nonce verification in the rd_ic_settings_page function, unauthenticated attackers can exploit this flaw to modify the plugin's settings. This could allow the injection of malicious scripts, which would be stored and executed in the admin area, potentially leading to unauthorized administrative actions if an administrator is tricked into clicking a malicious link.

References