CVE-2026-4002: 
WordPress vulnerability analysis and mitigation

CVE-2026-4002 is a Cross-Site Request Forgery (CSRF) vulnerability in the Petje.af plugin for WordPress affecting all versions up to and including 2.1.8. The flaw resides in the ajax_revoke_token() function, which handles the petjeaf_disconnect AJAX action without nonce validation, enabling unauthenticated attackers to trigger destructive account operations against authenticated users. It was published by the National Vulnerability Database on April 15, 2026, and added to the GitHub Advisory Database on April 22, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-352 (Cross-Site Request Forgery), specifically the absence of WordPress nonce validation in the ajax_revoke_token() function within class-petje-af-oauth2-provider.php (lines 326 and 346) and registered via class-petje-af.php (line 182). Because the AJAX action petjeaf_disconnect does not verify that the request originates from a legitimate, authenticated session, an attacker can craft a forged HTTP request that triggers the function. The function performs three destructive operations: revoking OAuth2 tokens, deleting user meta data, and deleting WordPress user accounts for users assigned the petjeaf_member role. Exploitation requires the victim to be authenticated and to click a malicious link or visit an attacker-controlled page (GitHub Advisory, Wordfence).

Successful exploitation results in unauthorized deletion of Petje.af member user accounts, revocation of OAuth2 tokens, and removal of associated user meta data — all without the victim's knowledge or consent. The primary impact is on integrity (unauthorized data/account modification), with no direct confidentiality or availability impact as scored. Affected users with the petjeaf_member role face permanent account loss, which could disrupt access to membership-gated content or services (GitHub Advisory, Wordfence).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.015–0.017%, placing it in the 4th percentile for exploitation likelihood within the next 30 days. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites using the Petje.af plugin (versions ≤ 2.1.8) via passive scanning, plugin enumeration tools, or public search engines (e.g., searching for petje-af in page source or HTTP headers).
2. Craft forged request: Construct an HTML page or link containing a hidden form or <img> tag that sends a POST or GET request to the target WordPress site's AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to petjeaf_disconnect.
3. Deliver payload: Distribute the malicious link or page to a target who is authenticated on the vulnerable WordPress site (e.g., via phishing email, social media, or embedding in a compromised third-party site).
4. Trigger account deletion: When the authenticated victim clicks the link or loads the page, their browser automatically sends the forged request with their session cookies, causing the ajax_revoke_token() function to execute — revoking their OAuth2 token, deleting user meta, and deleting their petjeaf_member WordPress account (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php with action=petjeaf_disconnect originating from unexpected or external referrers (non-site origins).
• Application Events: Unexpected WordPress user account deletions for users with the petjeaf_member role, particularly in bulk or outside normal user activity hours.
• Application Events: Sudden revocation of OAuth2 tokens associated with Petje.af accounts without corresponding user-initiated logout activity.
• Database: Removal of user meta entries associated with Petje.af (petjeaf_* meta keys) for multiple users in a short timeframe.

Update the Petje.af plugin to a version newer than 2.1.8, which includes nonce validation for the petjeaf_disconnect AJAX action. If an immediate update is not possible, disable or deactivate the Petje.af plugin until patching is complete. Site administrators should review WordPress user audit logs for unexpected account deletions affecting petjeaf_member role users and restore any affected accounts from backups (GitHub Advisory, Wordfence).