Cross-Site Request Forgery Vulnerability in mCatFilter Plugin for WordPress

CVE-2026-4139

What is CVE-2026-4139?

The mCatFilter plugin for WordPress is susceptible to Cross-Site Request Forgery due to the lack of nonce verification and capability checks within the compute_post() function. This function, initiated on every page load, processes $_POST data to update plugin settings. Without CSRF token validation, an unauthenticated attacker can exploit this vulnerability by tricking an administrator into performing an action. Through a crafted POST request, they can alter critical settings like category exclusion rules and feed flags, compromising the plugin's functionality and the site’s overall security.

References