CVE-2026-4139: 
WordPress vulnerability analysis and mitigation

CVE-2026-4139 is a Cross-Site Request Forgery (CSRF) vulnerability in the mCatFilter plugin for WordPress, affecting all versions up to and including 0.5.2. The flaw stems from the complete absence of nonce verification and capability checks in the plugin's compute_post() function, allowing unauthenticated attackers to modify plugin settings by tricking an administrator into clicking a forged link. It was published on April 22, 2026, and assigned a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The root cause is that the compute_post() function is registered in the plugin constructor via the plugins_loaded hook, meaning it executes on every WordPress page load. It directly reads and processes $_POST data to update plugin settings using update_option() without any CSRF token (nonce) validation or privilege checks, making it trivially exploitable via a crafted HTML form or link (GitHub Advisory). The vulnerable code is visible in the plugin source at lines 138, 320, and 339 of mcatfilter.php (WordPress Trac).

Successful exploitation allows an unauthenticated attacker to modify all mCatFilter plugin settings — including category exclusion rules, feed exclusion flags, and tag page exclusion flags — by tricking a logged-in site administrator into visiting a malicious page. The impact is limited to low integrity loss with no confidentiality or availability impact, meaning an attacker could alter content visibility and filtering behavior on the affected WordPress site but cannot directly access sensitive data or cause a denial of service (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.006–0.007%, placing it in the 1st percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering — specifically, tricking a site administrator into clicking a forged link — which raises the practical bar for abuse (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the mCatFilter plugin version 0.5.2 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft a malicious request: Create an HTML page or form that submits a POST request to the target WordPress site's URL with the desired mCatFilter settings parameters (e.g., category exclusion rules, feed flags) in the POST body.
3. Social engineering: Deliver the malicious link or page to a site administrator via phishing email, forum post, or other means, inducing them to visit the page while authenticated to their WordPress dashboard.
4. Settings modification: When the administrator's browser loads the attacker-controlled page, it automatically submits the forged POST request. Because compute_post() runs on every page load without nonce validation, the plugin processes the request and updates settings via update_option(), altering category exclusion rules or feed flags as specified by the attacker (GitHub Advisory, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST requests to the site's front-end or admin URLs with mCatFilter-related parameters (e.g., fields corresponding to category exclusion or feed flags) originating from unusual referrers or external domains.
• Database: Unexpected changes to WordPress wp_options table entries associated with the mCatFilter plugin (e.g., options updated by update_option() calls from the plugin) at unusual times or without corresponding admin activity.
• Behavioral: Unexplained changes to category filtering behavior, feed visibility, or tag page exclusion settings on the WordPress site without corresponding administrator action in the dashboard.

Site administrators should update the mCatFilter plugin to a version newer than 0.5.2, where this vulnerability has been patched. As an interim measure, consider disabling the plugin until an update is applied. Additionally, deploying a Web Application Firewall (WAF) capable of detecting anomalous POST requests targeting plugin settings endpoints can reduce risk. Administrators should also be cautious about clicking untrusted links while authenticated to their WordPress dashboard (GitHub Advisory, Wordfence).

The vulnerability was reported and disclosed by Wordfence, a leading WordPress security firm, and published to the GitHub Advisory Database on April 22, 2026. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified at this time (Wordfence, GitHub Advisory).