CVE-2026-27090: 
WordPress vulnerability analysis and mitigation

CVE-2026-27090 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Moose Kenta Companion WordPress plugin. It affects all versions of the plugin through 1.3.3 and allows unauthenticated remote attackers to perform unauthorized actions by tricking an authenticated user into visiting a malicious page. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly).

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), indicating that the Kenta Companion plugin fails to properly validate or enforce anti-CSRF tokens (nonces) on one or more sensitive actions. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, silently submits a forged request to the vulnerable plugin endpoint on the victim's behalf. No privileges are required by the attacker, but user interaction (the victim visiting the attacker-controlled page) is necessary for exploitation (Feedly).

Successful exploitation results in a low-integrity impact, allowing an attacker to perform unauthorized state-changing actions within the WordPress site on behalf of the authenticated victim. There is no direct confidentiality or availability impact. The practical consequence depends on what actions the vulnerable endpoint controls — possibilities include modifying plugin settings or site content — but the scope is limited to the affected WordPress installation (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is extremely low at 0.008%, reflecting a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick an authenticated WordPress administrator or user into clicking a malicious link (Feedly).

1. Reconnaissance: Identify WordPress sites running the Kenta Companion plugin at version 1.3.3 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Identify vulnerable action: Determine which plugin action or AJAX endpoint lacks proper nonce verification by reviewing the plugin's source code or public vulnerability disclosures.
3. Craft malicious request: Create an HTML page containing a hidden form or JavaScript that automatically submits a forged POST/GET request to the target WordPress site's vulnerable endpoint (e.g., wp-admin/admin-ajax.php?action=<vulnerable_action>) with desired parameters.
4. Deliver to victim: Send the malicious page link to an authenticated WordPress user (e.g., administrator) via phishing email, social media, or embedded in a comment.
5. Trigger forged action: When the victim visits the attacker's page while logged into the WordPress site, the browser automatically sends the forged request with the victim's session cookies, causing the plugin to execute the unauthorized action on the attacker's behalf (Feedly).

• Logs: WordPress access logs showing unexpected POST requests to wp-admin/admin-ajax.php or plugin-specific endpoints from unusual referrer URLs or external domains.
• Logs: WordPress audit logs (if enabled via a plugin) recording unexpected plugin setting changes or administrative actions attributed to legitimate user accounts at unusual times.
• Network: HTTP requests to WordPress admin endpoints originating from external or unfamiliar referrer headers, particularly with no direct user navigation context.

Users should update the Kenta Companion plugin to a version beyond 1.3.3 that includes proper nonce validation for all sensitive actions. Until a patched version is confirmed available, administrators should consider deactivating the plugin if it is not critical to site operation. Additionally, restricting access to the WordPress admin area via IP allowlisting can reduce the attack surface for CSRF-based attacks (Feedly, Patchstack).